theory Recycle_C

lemma cancelBadgedSends_ccorres:
  "ccorres dc xfdc (invs' and ep_at' ptr)
              (UNIV \<inter> {s. epptr_' s = Ptr ptr} \<inter> {s. badge_' s = bdg}) []
       (cancelBadgedSends ptr bdg) (Call cancelBadgedSends_'proc)" apply (cinit lift: epptr_' badge_' simp: whileAnno_def) apply (simp add: list_case_return
              cong: list.case_cong Structures_H.endpoint.case_cong call_ignore_cong
               del: Collect_const) apply (rule ccorres_pre_getEndpoint) apply (rule_tac R="ko_at' ep ptr" and xf'="ret__unsigned_'"
               and val="case ep of RecvEP q \<Rightarrow> scast EPState_Recv | IdleEP \<Rightarrow> scast EPState_Idle
                                | SendEP q \<Rightarrow> scast EPState_Send"
               in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule cmap_relationE1 [OF cmap_relation_ep], erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def
                     split: Structures_H.endpoint.split_asm) apply ceqv apply wpc apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rename_tac list) apply (simp add: Collect_True Collect_False endpoint_state_defs
                     ccorres_cond_iffs
                del: Collect_const cong: call_ignore_cong) apply (rule ccorres_rhs_assoc)+ apply (csymbr, csymbr) apply (drule_tac s = ep in sym, simp only:) apply (rule_tac P="ko_at' ep ptr and invs'" in ccorres_cross_over_guard) apply (rule ccorres_symb_exec_r) apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow[where r'=dc and xf'=xfdc, OF _ ceqv_refl]) apply (rule_tac P="ko_at' ep ptr"
                    in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule cmap_relationE1[OF cmap_relation_ep], assumption) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps setEndpoint_def) apply (rule rev_bexI) apply (rule setObject_eq; simp add: objBits_simps')[1] apply (clarsimp simp: rf_sr_def cstate_relation_def
                               Let_def carch_state_relation_def
                               cmachine_state_relation_def
                               ) apply (clarsimp simp: cpspace_relation_def
                               update_ep_map_tos
                               typ_heap_simps') apply (erule(1) cpspace_relation_ep_update_ep2) apply (simp add: cendpoint_relation_def endpoint_state_defs) subgoal by simp apply (rule ccorres_symb_exec_r) apply (rule_tac xs=list in filterM_voodoo) apply (rule_tac P="\<lambda>xs s. (\<forall>x \<in> set xs \<union> set list.
                   st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s)
                              \<and> distinct (xs @ list) \<and> ko_at' IdleEP ptr s
                              \<and> (\<forall>p. \<forall>x \<in> set (xs @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound})
                              \<and> valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s
                              \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s"
                     and P'="\<lambda>xs. {s. ep_queue_relation' (cslift s) (xs @ list)
                                         (head_C (queue_' s)) (end_C (queue_' s))}
                                \<inter> {s. thread_' s = (case list of [] \<Rightarrow> tcb_Ptr 0
                                                       | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}"
                      in ccorres_inst_voodoo) apply (induct_tac list) apply (rule allI) apply (rule iffD1 [OF ccorres_expand_while_iff_Seq]) apply (rule ccorres_tmp_lift2 [OF _ _ Int_lower1]) apply ceqv apply (simp add: ccorres_cond_iffs) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_duplicate_guard, rule ccorres_split_nothrow_novcg_dc) apply (rule ccorres_from_vcg, rule allI, rule conseqPre, vcg) apply clarsimp apply (drule obj_at_ko_at', clarsimp) apply (rule cmap_relationE1[OF cmap_relation_ep], assumption) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps tcb_queue_relation'_def) apply (case_tac x) apply (clarsimp simp: setEndpoint_def) apply (rule rev_bexI, rule setObject_eq,
                      (simp add: objBits_simps')+) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                 carch_state_relation_def
                 cmachine_state_relation_def
                 cpspace_relation_def typ_heap_simps'
                 update_ep_map_tos) apply (erule(1) cpspace_relation_ep_update_ep2) subgoal by (simp add: cendpoint_relation_def Let_def) subgoal by simp apply (clarsimp simp: tcb_at_not_NULL[OF pred_tcb_at']
                                    setEndpoint_def) apply (rule rev_bexI, rule setObject_eq,
                      (simp add: objBits_simps')+) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                                     carch_state_relation_def
                                     cmachine_state_relation_def
                                     cpspace_relation_def typ_heap_simps'
                                     update_ep_map_tos) apply (erule(1) cpspace_relation_ep_update_ep2) apply (simp add: cendpoint_relation_def Let_def) apply (subgoal_tac "tcb_at' (last (a # list)) \<sigma> \<and> tcb_at' a \<sigma>") apply (clarsimp simp: is_aligned_neg_mask_weaken[
                                        OF is_aligned_tcb_ptr_to_ctcb_ptr[where P=\<top>]]) subgoal by (simp add: tcb_queue_relation'_def EPState_Send_def mask_def) subgoal by (auto split: if_split) subgoal by simp apply (ctac add: rescheduleRequired_ccorres) apply (rule hoare_pre, wp weak_sch_act_wf_lift_linear set_ep_valid_objs') apply (clarsimp simp: weak_sch_act_wf_def sch_act_wf_def) apply (fastforce simp: valid_ep'_def pred_tcb_at' split: list.splits) apply (simp add: guard_is_UNIV_def) apply (rule allI) apply (rename_tac a lista x) apply (rule iffD1 [OF ccorres_expand_while_iff_Seq]) apply (rule ccorres_init_tmp_lift2, ceqv) apply (rule ccorres_guard_imp2) apply (simp add: bind_assoc
                       del: Collect_const) apply (rule ccorres_cond_true) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_pre_threadGet[where f=tcbState, folded getThreadState_def]) apply (rule ccorres_move_c_guard_tcb) apply csymbr apply (rule ccorres_abstract_cleanup) apply csymbr apply (rule ccorres_move_c_guard_tcb) apply (rule_tac P=\<top>
                      and P'="{s. ep_queue_relation' (cslift s) (x @ a # lista)
                                        (head_C (queue_' s)) (end_C (queue_' s))}"
                      and f'="\<lambda>s. s \<lparr> next___ptr_to_struct_tcb_C_' := (case lista of [] \<Rightarrow> tcb_Ptr 0
                                              | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) \<rparr>"
                      and xf'="next___ptr_to_struct_tcb_C_'"
                           in ccorres_subst_basic_helper) apply (thin_tac "\<forall>x. P x" for P) apply (rule myvars.fold_congs, (rule refl)+) apply (clarsimp simp: tcb_queue_relation'_def use_tcb_queue_relation2
                                     tcb_queue_relation2_concat) apply (clarsimp simp: typ_heap_simps split: list.split) subgoal by (simp add: rf_sr_def) apply simp apply ceqv apply (rule_tac P="ret__unsigned=blockingIPCBadge rv" in ccorres_gen_asm2) apply (rule ccorres_if_bind, rule ccorres_if_lhs) apply (simp add: bind_assoc) apply (rule ccorres_rhs_assoc)+ apply (ctac add: setThreadState_ccorres) apply (ctac add: tcbSchedEnqueue_ccorres) apply (rule_tac P="\<lambda>s. \<forall>t \<in> set (x @ a # lista). tcb_at' t s"
                             in ccorres_cross_over_guard) apply (rule ccorres_add_return, rule ccorres_split_nothrow[OF _ ceqv_refl]) apply (rule_tac rrel=dc and xf=xfdc
                               and P="\<lambda>s. (\<forall>t \<in> set (x @ a # lista). tcb_at' t s)
                                          \<and> (\<forall>p. \<forall>t \<in> set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound})
                                          \<and> valid_queues s \<and> distinct (x @ a # lista)
                                          \<and> pspace_aligned' s \<and> pspace_distinct' s"
                              and P'="{s. ep_queue_relation' (cslift s) (x @ a # lista)
                                           (head_C (queue_' s)) (end_C (queue_' s))}"
                               in ccorres_from_vcg) apply (thin_tac "\<forall>x. P x" for P) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: ball_Un) apply (rule exI, rule conjI) apply (rule exI, erule conjI) apply (intro conjI[rotated]) apply (assumption) apply (fold_subgoals (prefix))[3] subgoal premises prems using prems by (fastforce intro: pred_tcb_at')+ apply (clarsimp simp: return_def rf_sr_def cstate_relation_def Let_def) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def) apply (rule conjI, erule ctcb_relation_null_queue_ptrs) apply (rule null_ep_queue) subgoal by (simp add: o_def) apply (rule conjI) apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply clarsimp apply (rule cendpoint_relation_q_cong) apply (rule sym, erule restrict_map_eqI) apply (clarsimp simp: image_iff) apply (drule(2) map_to_ko_atI) apply (drule ko_at_state_refs_ofD') apply clarsimp apply (drule_tac x=p in spec) subgoal by fastforce apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply clarsimp apply (drule(2) map_to_ko_atI, drule ko_at_state_refs_ofD') apply (rule cnotification_relation_q_cong) apply (rule sym, erule restrict_map_eqI) apply (clarsimp simp: image_iff) apply (drule_tac x=p in spec) subgoal by fastforce apply (rule conjI) apply (erule cready_queues_relation_not_queue_ptrs;
                           fastforce dest: null_ep_schedD[unfolded o_def] simp: o_def) apply (simp add: carch_state_relation_def
                                    cmachine_state_relation_def
                                    h_t_valid_clift_Some_iff) apply (rule ccorres_symb_exec_r2) apply (erule spec) apply vcg apply (vcg spec=modifies) apply wp apply simp apply vcg apply (wp hoare_vcg_const_Ball_lift tcbSchedEnqueue_ep_at
                         sch_act_wf_lift) apply simp apply (vcg exspec=tcbSchedEnqueue_cslift_spec) apply (wp hoare_vcg_const_Ball_lift sts_st_tcb_at'_cases
                       sts_sch_act sts_valid_queues setThreadState_oa_queued) apply (vcg exspec=setThreadState_cslift_spec) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_symb_exec_r2) apply (drule_tac x="x @ [a]" in spec, simp) apply vcg apply (vcg spec=modifies) apply (thin_tac "\<forall>x. P x" for P) apply (clarsimp simp: pred_tcb_at' ball_Un) apply (rule conjI) apply (clarsimp split: if_split) subgoal by (fastforce simp: valid_tcb_state'_def valid_objs'_maxDomain
                                  valid_objs'_maxPriority dest: pred_tcb_at') apply (clarsimp simp: tcb_at_not_NULL [OF pred_tcb_at']) apply (clarsimp simp: typ_heap_simps st_tcb_at'_def) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: ctcb_relation_blocking_ipc_badge) apply (rule conjI, simp add: "StrictC'_thread_state_defs" mask_def) apply (rule conjI) apply clarsimp apply (frule rf_sr_cscheduler_relation) apply (clarsimp simp: cscheduler_action_relation_def st_tcb_at'_def
                          split: scheduler_action.split_asm) apply (rename_tac word) apply (frule_tac x=word in tcbSchedEnqueue_cslift_precond_discharge) apply simp subgoal by clarsimp subgoal by clarsimp subgoal by clarsimp apply clarsimp apply (rule conjI) apply (frule(3) tcbSchedEnqueue_cslift_precond_discharge) subgoal by clarsimp apply clarsimp apply (rule context_conjI) apply (clarsimp simp: tcb_queue_relation'_def) apply (erule iffD2[OF ep_queue_relation_shift[rule_format], rotated -1]) subgoal by simp apply (rule_tac x="x @ a # lista" in exI) apply (clarsimp simp: ball_Un) apply (rule conjI, fastforce) subgoal by (clarsimp simp: remove1_append) apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (wp hoare_vcg_const_Ball_lift) apply (wp obj_at_setObject3[where 'a=endpoint, folded setEndpoint_def]) apply (simp add: objBits_simps')+ apply (wp set_ep_valid_objs') apply vcg apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: guard_is_UNIV_def) apply (erule cmap_relationE1[OF cmap_relation_ep], erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps) apply (clarsimp simp: cendpoint_relation_def Let_def) subgoal by (clarsimp simp: tcb_queue_relation'_def neq_Nil_conv
                  split: if_split_asm) apply clarsimp apply (frule ko_at_valid_objs', clarsimp) apply (simp add: projectKOs) apply (clarsimp simp: valid_obj'_def valid_ep'_def) apply (frule sym_refs_ko_atD', clarsimp) apply (clarsimp simp: st_tcb_at_refs_of_rev') apply (rule conjI) subgoal by (auto simp: isBlockedOnSend_def elim!: pred_tcb'_weakenE) apply (rule conjI) apply (clarsimp split: if_split) apply (drule sym_refsD, clarsimp) apply (drule(1) bspec)+ by (auto simp: obj_at'_def projectKOs state_refs_of'_def pred_tcb_at'_def tcb_bound_refs'_def
              dest!: symreftype_inverse')

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and ep_at' ptr) (UNIV \<inter> \<lbrace>\<acute>epptr = ep_Ptr ptr\<rbrace> \<inter> \<lbrace>\<acute>badge = bdg\<rbrace>) [] (cancelBadgedSends ptr bdg) (Call cancelBadgedSends_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>badge epptr. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1394 badge epptr) (?Q'1394 badge epptr) [SKIP] (do ep <- getEndpoint ptr;
case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- swp filterM queue (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od);
ep' <- case queue' of [] \<Rightarrow> return Structures_H.endpoint.IdleEP | a # list \<Rightarrow> return $ Structures_H.endpoint.SendEP queue';
setEndpoint ptr ep';
rescheduleRequired
od | _ \<Rightarrow> return ()
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = badge THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1394 badge epptr s \<and> s' \<in> ?Q'1394 badge epptr proof (prove)
goal (2 subgoals):
 1. \<And>badge epptr. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1394 bdg (ep_Ptr ptr)) (?Q'1394 bdg (ep_Ptr ptr)) [SKIP] (do ep <- getEndpoint ptr;
case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1394 badge epptr s \<and> s' \<in> ?Q'1394 badge epptr proof (prove)
goal (2 subgoals):
 1. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P1412 bdg (ep_Ptr ptr) a ep) (?P'1410 bdg (ep_Ptr ptr) ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ?P1412 badge epptr s ep)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> ?P'1410 badge epptr ep} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ep ptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptr) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)\<rbrace>)
 2. \<And>badge epptr ep rv' t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI) (?y'1415 badge epptr ep rv')
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'1415 badge epptr ep (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s. UNIV \<inter> {s'. ko_at' ep ptr s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ret__unsigned. ret__unsigned = endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr ptr)))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr ptr))))\<rparr>) \<in> rf_sr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift sa (ep_Ptr ptr)))) = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))}
 2. \<And>badge epptr ep rv' t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI) (?y'1415 badge epptr ep rv')
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'1415 badge epptr ep (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s x. \<lbrakk>ko_at' ep ptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr ptr)))) = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>badge epptr ep rv' t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI) (?y'1415 badge epptr ep rv')
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'1415 badge epptr ep (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s x y'. \<lbrakk>ko_at' ep ptr s; map_to_eps (ksPSpace s) ptr = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr ptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr ptr)))) = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>badge epptr ep rv' t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI) (?y'1415 badge epptr ep rv')
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'1415 badge epptr ep (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badge epptr ep rv' t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI) (?y'1415 badge epptr ep rv')
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'1415 badge epptr ep (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 4. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1419 bdg (ep_Ptr ptr) ep) (?Q1415 badge epptr ep) [SKIP] (case ep of Structures_H.endpoint.SendEP queue \<Rightarrow> do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) queue;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od | _ \<Rightarrow> return ()) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q1415 badge epptr ep)
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> (?P1419 badge epptr ep and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep x1. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1803 bdg (ep_Ptr ptr) ep x1) (?R''1785 badge epptr ep x1) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1791 bdg (ep_Ptr ptr) ep) (?R''1783 badge epptr ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>badge epptr ep x3. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a x3) (?R''1782 badge epptr ep x3) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) x3;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''1785 badge epptr ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''1783 badge epptr ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R1803 badge epptr ep x a) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R1791 badge epptr ep a) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep x1. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1803 bdg (ep_Ptr ptr) (Structures_H.endpoint.RecvEP x1) x1) (?R''1785 bdg (ep_Ptr ptr) (Structures_H.endpoint.RecvEP x1) x1) [SKIP] (return ()) SKIP
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1791 bdg (ep_Ptr ptr) ep) (?R''1783 badge epptr ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>badge epptr ep x3. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a x3) (?R''1782 badge epptr ep x3) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) x3;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''1785 badge epptr ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''1783 badge epptr ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R1803 badge epptr ep x a) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R1791 badge epptr ep a) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1791 bdg (ep_Ptr ptr) ep) (?R''1783 badge epptr ep) [SKIP] (return ()) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr ep x3. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a x3) (?R''1782 badge epptr ep x3) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) x3;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''1783 badge epptr ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 4. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R1791 badge epptr ep a) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1791 bdg (ep_Ptr ptr) Structures_H.endpoint.IdleEP) (?R''1783 bdg (ep_Ptr ptr) Structures_H.endpoint.IdleEP) [SKIP] (return ()) SKIP
 2. \<And>badge epptr ep x3. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a x3) (?R''1782 badge epptr ep x3) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) x3;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''1783 badge epptr ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 4. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R1791 badge epptr ep a) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep x3. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a x3) (?R''1782 badge epptr ep x3) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) x3;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) ep a list) (?R''1782 badge epptr ep list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<or> (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  SKIP
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send THEN
  lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?R1790 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) a list) (?R''1782 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (lvar_nondet_init thread_' thread_'_update;;
lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>thread :== head_C \<acute>queue;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1790 badge epptr ep a x)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1819 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) list) (?R''1782 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (lvar_nondet_init thread_' thread_'_update;;
(lvar_nondet_init next___ptr_to_struct_tcb_C_' next___ptr_to_struct_tcb_C_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
(CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
(CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))))
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''1782 badge epptr ep x}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1819 badge epptr ep x a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1819 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) list) (?G'1880 bdg (ep_Ptr ptr) (Structures_H.endpoint.SendEP list) list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptr);;
(CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
(CALL endpoint_ptr_set_epQueue_head_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(epptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(epptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> ?G'1880 badge epptr ep x}}}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1819 badge epptr ep x a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1819 bdg (ep_Ptr ptr) ep list) (?G'1880 bdg (ep_Ptr ptr) ep list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> ?G'1880 badge epptr ep x}}}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R1819 badge epptr ep x a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1899 bdg (ep_Ptr ptr) ep list) (?Q1897 bdg (ep_Ptr ptr) ep list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and ?P'1899 badge epptr ep x) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1899 bdg (ep_Ptr ptr) ep list) (?Q'1901 badge epptr ep list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
(CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))))
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (?Q'1901 badge epptr ep list)
 3. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; ?P'1899 bdg (ep_Ptr ptr) ep list s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and ?P'1899 badge epptr ep x) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1899 bdg (ep_Ptr ptr) ep list) (?Q'1901 badge epptr ep list) [SKIP] (do y <- setEndpoint ptr Structures_H.endpoint.IdleEP;
queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
(\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (?Q'1901 badge epptr ep list)
 3. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; ?P'1899 bdg (ep_Ptr ptr) ep list s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and ?P'1899 badge epptr ep x) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1920 bdg (ep_Ptr ptr) ep list) (?P'1913 badge epptr ep list) [SKIP] (setEndpoint ptr Structures_H.endpoint.IdleEP) (CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (?P'1913 badge epptr ep list \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (?P1920 bdg (ep_Ptr ptr) ep list and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (?P1920 badge epptr ep x and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ko_at' ep ptr \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badge epptr ep list \<sigma>. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> {s. ko_at' ep ptr \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ptr Structures_H.endpoint.IdleEP \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))))}
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace \<sigma>) (?x2008 list \<sigma> x) = Some (?y2008 list \<sigma> x)
 2. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) (?x2008 list \<sigma> x) = Some (?y2008 list \<sigma> x); cendpoint_relation (cslift x) (?y2008 list \<sigma> x) y'; cslift x (ep_Ptr (?x2008 list \<sigma> x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y'. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift x (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ptr Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> ?x2028 list \<sigma> x y' t endpoint ta endpointa tb endpointb \<in> fst (setObject ptr Structures_H.endpoint.IdleEP \<sigma>)
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ?x2028 list \<sigma> x y' t endpoint ta endpointa tb endpointb of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ptr \<mapsto> injectKOS Structures_H.endpoint.IdleEP)\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>ko_at' (Structures_H.endpoint.SendEP list) ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ptr \<mapsto> endpointb)) ep_Ptr (cendpoint_relation (cslift x))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) Structures_H.endpoint.IdleEP endpointb
 2. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x = cslift x
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>list \<sigma> x y' t endpoint ta endpointa tb endpointb. \<lbrakk>map_to_eps (ksPSpace \<sigma>) ptr = Some (Structures_H.endpoint.SendEP list); cendpoint_relation (cslift x) (Structures_H.endpoint.SendEP list) y'; cslift x (ep_Ptr ptr) = Some y'; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x = cslift x
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>map_to_eps (ksPSpace \<sigma>_) ptr = Some (Structures_H.endpoint.SendEP list_); cendpoint_relation (cslift x_) (Structures_H.endpoint.SendEP list_) y'_; cslift x_ (ep_Ptr ptr) = Some y'_; endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals x_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals x_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x_ = cslift x_ proof (prove)
goal (7 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'1913 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== head_C \<acute>queue;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 5. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 7. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1913 badge epptr ep list rv) (?Q'2104 badge epptr ep list rv rv') [SKIP] (do queue' <- filterM (\<lambda>t. do st <- getThreadState t;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t;
return False
od else return True
od) list;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue (?Q'2104 badge epptr ep list rv rv')
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; ?Q1913 badge epptr ep list rv s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>?Q1913 badge epptr ep list\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<forall>ys. ccorres dc xfdc (?Q2112 badge epptr ep list rv ys (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list;
return (ys @ zs)
od)) (?Q'2110 badge epptr ep list rv rv' ys (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list;
return (ys @ zs)
od)) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list;
return (ys @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue (?Q'2110 badge epptr ep list rv rv' [] (filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list))
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; ?Q2112 badge epptr ep list rv [] (filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv. ?Q2112 badge epptr ep list rv [] (filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list)\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) list;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set []. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ []) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ []). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ []) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) [];
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv rv' x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set []. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ []) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ []). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ []) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) [];
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv rv' x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set []. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ []) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ []). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ []) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) [];
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF \<acute>thread \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv rv' x t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> thread_' (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x) t t' (IF \<acute>thread \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI) (?c'2120 badge epptr ep list rv rv' x)
 2. \<And>badge epptr ep list rv rv' x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set []. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ []) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ []). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) (x @ []) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) [];
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'2120 badge epptr ep list rv rv' x)
 3. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv rv' x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set []. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ []) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ []). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) (x @ []) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) [];
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c (case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x);;
\<acute>queue :== CALL tcbEPDequeue_'proc(case [] of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) x (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [SKIP] (do y <- setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) x (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [SKIP] (do y <- setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) x (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [] (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list))) (CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI)
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list x \<sigma>. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> {s. ((\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr \<sigma> \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues \<sigma> \<and> pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma> \<and> sch_act_wf (ksSchedulerAction \<sigma>) \<sigma> \<and> valid_objs' \<sigma>) \<and> s \<in> {s. ep_queue_relation' (cslift s) x (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' s)) && ~~ mask 4, epQueue_tail_CL := ptr_val (StateRelation_C.end_C (queue_' s)) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals s))) \<longrightarrow> (head_C (queue_' s) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>))))) \<and> (head_C (queue_' s) = NULL \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)))))}
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ep_queue_relation' (cslift xa) x (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift xa (ep_Ptr ptr)))\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (StateRelation_C.end_C (queue_' xa)) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))) \<longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ep_queue_relation' (cslift xa) x (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift xa (ep_Ptr ptr)))\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (StateRelation_C.end_C (queue_' xa)) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))) \<longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x \<sigma> xa. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ep_queue_relation' (cslift xa) x (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace \<sigma>) (?x2530 x \<sigma> xa) = Some (?y2530 x \<sigma> xa)
 2. \<And>x \<sigma> xa y'. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ep_queue_relation' (cslift xa) x (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) (?x2530 x \<sigma> xa) = Some (?y2530 x \<sigma> xa); cendpoint_relation (cslift xa) (?y2530 x \<sigma> xa) y'; cslift xa (ep_Ptr (?x2530 x \<sigma> xa)) = Some y'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift xa (ep_Ptr ptr)))\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (StateRelation_C.end_C (queue_' xa)) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))) \<longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x \<sigma> xa y'. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ep_queue_relation' (cslift xa) x (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'\<rbrakk> \<Longrightarrow> xa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift xa (ep_Ptr ptr)))\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (StateRelation_C.end_C (queue_' xa)) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))) \<longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x \<sigma> xa y' t ep'. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x \<sigma> xa y' t ep'. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = []\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (setObject ptr Structures_H.endpoint.IdleEP \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP)\<rparr>, xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift xa)(ep_Ptr ptr \<mapsto> ep')) ep_Ptr (cendpoint_relation (cslift xa))
 2. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP ep'
 2. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 3. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 6. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 7. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Invariants_H.valid_queues \<sigma>_; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; sch_act_wf (ksSchedulerAction \<sigma>_) \<sigma>_; valid_objs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa_) Structures_H.endpoint.IdleEP y'_; cslift xa_ (ep_Ptr ptr) = Some y'_; StateRelation_C.end_C (queue_' xa_) = NULL; head_C (queue_' xa_) = NULL; endpoint_lift ep'_ = endpoint_lift y'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_)); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); armKSNextASID_' (globals xa_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals xa_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals xa_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals xa_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals xa_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals xa_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals xa_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals xa_)); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift xa_) Structures_H.endpoint.IdleEP ep'_ proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep'. \<lbrakk>Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = NULL; head_C (queue_' xa) = NULL; endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 2. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Invariants_H.valid_queues \<sigma>_; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; sch_act_wf (ksSchedulerAction \<sigma>_) \<sigma>_; valid_objs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa_) Structures_H.endpoint.IdleEP y'_; cslift xa_ (ep_Ptr ptr) = Some y'_; StateRelation_C.end_C (queue_' xa_) = NULL; head_C (queue_' xa_) = NULL; endpoint_lift ep'_ = endpoint_lift y'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_)); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); armKSNextASID_' (globals xa_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals xa_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals xa_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals xa_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals xa_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals xa_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals xa_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals xa_)); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cslift xa_ = cslift xa_ proof (prove)
goal (13 subgoals):
 1. \<And>x \<sigma> xa y' t ep' a list. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; distinct x; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)); ep_queue_relation (cslift xa) x NULL (head_C (queue_' xa)); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); x = a # list\<rbrakk> \<Longrightarrow> (head_C (queue_' xa) \<noteq> NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (head_C (queue_' xa)) && ~~ mask 4, epQueue_tail_CL := ptr_val (if x = [] then NULL else tcb_ptr_to_ctcb_ptr (last x)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))) \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (head_C (queue_' xa) = NULL \<longrightarrow> (\<exists>x\<in>fst (setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (setObject ptr (Structures_H.endpoint.SendEP (a # list)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; (\<sigma>, xa) \<in> rf_sr; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint (Structures_H.endpoint.SendEP (a # list)))\<rparr>, xa\<lparr>globals := globals xa\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; ko_at' Structures_H.endpoint.IdleEP ptr \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ptr \<mapsto> KOEndpoint (Structures_H.endpoint.SendEP (a # list))))) ((cslift xa)(ep_Ptr ptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift xa))
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift xa) (Structures_H.endpoint.SendEP (a # list)) endpoint
 2. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift xa) (a # list) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4)) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4))
 2. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; tcb_at' (last (a # list)) \<sigma> \<and> tcb_at' a \<sigma>\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift xa) (a # list) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4)) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4))
 2. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> tcb_at' (last (a # list)) \<sigma> \<and> tcb_at' a \<sigma>
 3. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 4. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 6. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 7. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a), epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list))\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a), epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)), endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; tcb_at' (if list = [] then a else last list) \<sigma>; tcb_at' a \<sigma>; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift xa) (a # list) (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list))
 2. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> tcb_at' (last (a # list)) \<sigma> \<and> tcb_at' a \<sigma>
 3. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 4. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 6. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 7. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list_. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>_; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; sch_act_wf (ksSchedulerAction \<sigma>_) \<sigma>_; valid_objs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) ptr = Some Structures_H.endpoint.IdleEP; cslift xa_ (ep_Ptr ptr) = Some y'_; StateRelation_C.end_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_); endpoint_lift ep'_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_), epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_))\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a_ \<sigma>_; \<forall>x\<in>set list_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>_; a_ \<notin> set list_; distinct list_; head_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr a_; cslift xa_ (tcb_ptr_to_ctcb_ptr a_) = Some tcb_; tcbEPPrev_C tcb_ = NULL; ep_queue_relation (cslift xa_) list_ (tcb_ptr_to_ctcb_ptr a_) (tcbEPNext_C tcb_); endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_), epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)), endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_))); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); armKSNextASID_' (globals xa_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals xa_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals xa_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals xa_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals xa_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals xa_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals xa_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals xa_)); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_; endpoint_CL.state_CL (endpoint_lift y'_) = SCAST(32 signed \<rightarrow> 32) EPState_Idle; tcb_at' (if list_ = [] then a_ else last list_) \<sigma>_; tcb_at' a_ \<sigma>_; epQueue_tail_CL (endpoint_lift y'_) = 0; epQueue_head_CL (endpoint_lift y'_) = 0\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift xa_) (a_ # list_) (tcb_ptr_to_ctcb_ptr a_) (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)) proof (prove)
goal (14 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> tcb_at' (last (a # list)) \<sigma> \<and> tcb_at' a \<sigma>
 2. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 3. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 5. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 6. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list_. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>_; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; sch_act_wf (ksSchedulerAction \<sigma>_) \<sigma>_; valid_objs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) ptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y'_) = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y'_) = 0 \<and> epQueue_head_CL (endpoint_lift y'_) = 0; cslift xa_ (ep_Ptr ptr) = Some y'_; StateRelation_C.end_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_); endpoint_lift ep'_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)) && ~~ mask 4\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a_ \<sigma>_; \<forall>x\<in>set list_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>_; a_ \<notin> set list_; distinct list_; head_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr a_; cslift xa_ (tcb_ptr_to_ctcb_ptr a_) = Some tcb_; tcbEPPrev_C tcb_ = NULL; ep_queue_relation (cslift xa_) list_ (tcb_ptr_to_ctcb_ptr a_) (tcbEPNext_C tcb_); endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_))); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); armKSNextASID_' (globals xa_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals xa_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals xa_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals xa_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals xa_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals xa_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals xa_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals xa_)); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> tcb_at' (last (a_ # list_)) \<sigma>_ \<and> tcb_at' a_ \<sigma>_ proof (prove)
goal (13 subgoals):
 1. \<And>\<sigma> xa y' t ep' a list tcb ta endpoint. \<lbrakk>\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; sch_act_wf (ksSchedulerAction \<sigma>) \<sigma>; valid_objs' \<sigma>; map_to_eps (ksPSpace \<sigma>) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa) Structures_H.endpoint.IdleEP y'; cslift xa (ep_Ptr ptr) = Some y'; StateRelation_C.end_C (queue_' xa) = tcb_ptr_to_ctcb_ptr (if list = [] then a else last list); endpoint_lift ep' = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a \<sigma>; \<forall>x\<in>set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>; a \<notin> set list; distinct list; head_C (queue_' xa) = tcb_ptr_to_ctcb_ptr a; cslift xa (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = NULL; ep_queue_relation (cslift xa) list (tcb_ptr_to_ctcb_ptr a) (tcbEPNext_C tcb); endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list = [] then a else last list)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (hrs_mem_update (heap_update (ep_Ptr ptr) ep') (t_hrs_' (globals xa))); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); armKSNextASID_' (globals xa) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals xa)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals xa)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals xa)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals xa)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals xa)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals xa)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals xa)); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift xa = cslift xa
 2. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 4. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 5. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set list_. \<forall>rf. (x, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>_; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; sch_act_wf (ksSchedulerAction \<sigma>_) \<sigma>_; valid_objs' \<sigma>_; map_to_eps (ksPSpace \<sigma>_) ptr = Some Structures_H.endpoint.IdleEP; cendpoint_relation (cslift xa_) Structures_H.endpoint.IdleEP y'_; cslift xa_ (ep_Ptr ptr) = Some y'_; StateRelation_C.end_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_); endpoint_lift ep'_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)) && ~~ mask 4\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a_ \<sigma>_; \<forall>x\<in>set list_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x \<sigma>_; a_ \<notin> set list_; distinct list_; head_C (queue_' xa_) = tcb_ptr_to_ctcb_ptr a_; cslift xa_ (tcb_ptr_to_ctcb_ptr a_) = Some tcb_; tcbEPPrev_C tcb_ = NULL; ep_queue_relation (cslift xa_) list_ (tcb_ptr_to_ctcb_ptr a_) (tcbEPNext_C tcb_); endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr a_) && ~~ mask 4, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (if list_ = [] then a_ else last list_)) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Send && mask 2\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ptr) ep'_) (t_hrs_' (globals xa_))); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); armKSNextASID_' (globals xa_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals xa_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals xa_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift xa_ \<circ>\<^sub>m pd_pointer_to_asid_slot); carch_globals (ksArchState \<sigma>_); irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals xa_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals xa_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals xa_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals xa_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals xa_)); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cslift xa_ = cslift xa_ proof (prove)
goal (12 subgoals):
 1. \<And>badge epptr ep list x y rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc y rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2447 badge epptr ep list x y) (?Q'2447 badge epptr ep list x y rv') [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>?Q2447 badge epptr ep list x\<rbrace>
 3. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'2447 badge epptr ep list x)
 4. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 5. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 6. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 10. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace> setEndpoint ptr (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) \<lbrace>\<lambda>y. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs'\<rbrace>
 2. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. s \<in> UNIV})
 3. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list x s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list))) s
 2. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. s \<in> UNIV})
 3. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x s. \<lbrakk>\<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound; Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; Structures_H.scheduler_action.rec_scheduler_action (ct_in_state' activatable') (\<lambda>_. True) (\<lambda>t s. st_tcb_at' runnable' t s \<and> tcb_in_cur_domain' t s) (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<forall>t. ksSchedulerAction s = SwitchToThread t \<longrightarrow> st_tcb_at' runnable' t s \<and> tcb_in_cur_domain' t s) \<and> valid_ep' (case x of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list)) s
 2. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. s \<in> UNIV})
 3. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>y rv'. {s. s \<in> UNIV})
 2. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' x1 x2. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' x1 x2 x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set x2. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) x2;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (x1 # x2). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ x1 # x2) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ x1 # x2). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ x1 # x2) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case x1 # x2 of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (x1 # x2);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (a # lista);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (a # lista);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF \<acute>thread \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (a # lista);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x);;
\<acute>queue :== CALL tcbEPDequeue_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3076 badge epptr ep list rv rv' a lista x) (?Q'3076 badge epptr ep list rv rv' a lista x) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) (a # lista);
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x) \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c (case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x);;
\<acute>queue :== CALL tcbEPDequeue_'proc(case a # lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> ?Q3076 badge epptr ep list rv rv' a lista x s \<and> s' \<in> ?Q'3076 badge epptr ep list rv rv' a lista x
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3076 bdg (ep_Ptr ptr) ep list () rv' a lista x) (?Q'3076 bdg (ep_Ptr ptr) ep list () rv' a lista x) [SKIP] (do xa <- getThreadState a;
xa <- if blockingIPCBadge xa = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF tcb_ptr_to_ctcb_ptr a \<noteq> NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))
ELSE
  CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())
FI)
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> ?Q3076 badge epptr ep list rv rv' a lista x s \<and> s' \<in> ?Q'3076 badge epptr ep list rv rv' a lista x
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3076 bdg (ep_Ptr ptr) ep list () rv' a lista x) (?R'3095 bdg (ep_Ptr ptr) ep list () rv' a lista x) [SKIP] (do xa <- getThreadState a;
xa <- if blockingIPCBadge xa = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> ?Q3076 badge epptr ep list rv rv' a lista x s \<and> s' \<in> ?R'3095 badge epptr ep list rv rv' a lista x \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3076 bdg (ep_Ptr ptr) ep list () rv' a lista x) (?R'3095 bdg (ep_Ptr ptr) ep list () rv' a lista x) [SKIP] (do xa <- getThreadState a;
xa <- if blockingIPCBadge xa = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])));;
(\<acute>b :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> ?Q3076 badge epptr ep list rv rv' a lista x s \<and> s' \<in> ?R'3095 badge epptr ep list rv rv' a lista x \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P3124 ep list rv' a lista x rv) (?P'3123 ep list rv' a lista x rv) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])));;
(\<acute>b :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ?P3121 badge epptr ep list rv rv' a lista x s tcb) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?P'3122 badge epptr ep list rv rv' a lista x tcb} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list rv' a lista x s tcb. ?P3124 ep list rv' a lista x (tcbState tcb) s \<equiv>\<^sup>? \<lambda>ep list. ?P3121 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list rv' a lista x tcb. ?P'3123 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?P'3122 bdg (ep_Ptr ptr) ep list () proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3133 ep list rv' a lista x rv) (?C'3131 ep list rv' a lista x rv) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C'']));;
(\<acute>b :== \<acute>ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> (?A3134 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> ?C'3130 badge epptr ep list rv rv' a lista x tcb \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?C'3131 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?C'3130 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?A3134 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?A3133 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3133 ep list rv' a lista x rv) (?G'3149 ep list rv' a lista x rv ret__unsigned \<inter> {s. ret__unsigned = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))}) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>b :== ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> (?A3134 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'3150 badge epptr ep list rv rv' a lista x tcb v}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?G'3150 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?G'3149 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?A3134 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?A3133 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3133 ep list rv' a lista x rv) (?G'3473 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>b :== ret__unsigned;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> (?A3134 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> ?G'3474 badge epptr ep list rv rv' a lista x tcb v}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?G'3474 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?G'3473 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?A3134 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?A3133 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3133 ep list rv' a lista x rv) (?G'3486 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])));;
(IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> (?A3134 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> ?G'3487 badge epptr ep list rv rv' a lista x tcb v}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?G'3487 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?G'3486 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?A3134 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?A3133 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A3793 ep list rv' a lista x rv) (?C'3791 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C'']));;
(IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> (?A3794 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> ?C'3790 badge epptr ep list rv rv' a lista x tcb v \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?C'3791 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?C'3790 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?A3794 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?A3793 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (14 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s'\<lparr>next___ptr_to_struct_tcb_C_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C'']))\<rparr> = s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (s, s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 6. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () proof (prove)
goal (14 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> s'\<lparr>next___ptr_to_struct_tcb_C_' := h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C'']))\<rparr> = s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (s, s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 6. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (14 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s' v. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr; next___ptr_to_struct_tcb_C_' s' = v\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])) = (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (s, s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 6. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (14 subgoals):
 1. \<And>a lista x s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; StateRelation_C.end_C (queue_' s') = tcb_ptr_to_ctcb_ptr (if lista = [] then a else last lista); tcb_queue_relation2 tcbEPNext_C tcbEPPrev_C (cslift s') (map tcb_ptr_to_ctcb_ptr x) NULL (tcb_ptr_to_ctcb_ptr a); head_C (queue_' s') = hd (map tcb_ptr_to_ctcb_ptr x @ tcb_ptr_to_ctcb_ptr a # map tcb_ptr_to_ctcb_ptr lista @ [NULL]); cslift s' (tcb_ptr_to_ctcb_ptr a) = Some tcb; tcbEPPrev_C tcb = (if x = [] then NULL else last (map tcb_ptr_to_ctcb_ptr x)); tcbEPNext_C tcb = hd (map tcb_ptr_to_ctcb_ptr lista @ [NULL]); tcb_queue_relation2 tcbEPNext_C tcbEPPrev_C (cslift s') (map tcb_ptr_to_ctcb_ptr lista) (tcb_ptr_to_ctcb_ptr a) NULL\<rbrakk> \<Longrightarrow> h_val (hrs_mem (t_hrs_' (globals s'))) (PTR(tcb_C ptr) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbEPNext_C''])) = (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (s, s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 6. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (s, s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 5. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>badge_ = bdg; epptr_ = ep_Ptr ptr; Structures_H.endpoint.SendEP list_ = ep_; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista_ \<and> set x \<inter> set lista_ = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista_) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista_ of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista_;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); True; s'_ \<in> {s. ep_queue_relation' (cslift s) (x_ @ a_ # lista_) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}; (s_, s'_) \<in> rf_sr\<rbrakk> \<Longrightarrow> (s_, s'_\<lparr>next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) \<in> rf_sr proof (prove)
goal (12 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> next___ptr_to_struct_tcb_C_' (s'\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>) = ?v3796 badge epptr ep list rv' a lista x rv ret__unsigned
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (?v3796 badge epptr ep list rv' a lista x rv ret__unsigned))
 4. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 5. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 6. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 10. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rv'a t t'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> next___ptr_to_struct_tcb_C_' rv'a t t' (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C;;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned rv'a)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (?c'3796 badge epptr ep list rv' a lista x rv ret__unsigned (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v))
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?Q'3802 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?Q'3803 badge epptr ep list rv rv' a lista x tcb v} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Q'3803 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q'3802 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3805 ep list rv' a lista x rv) (?G'4105 ep list rv' a lista x rv ret__unsigned) [SKIP] (do xa <- if blockingIPCBadge rv = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if xa then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and ?Q3806 badge epptr ep list rv rv' a lista x tcb and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> ?G'4103 badge epptr ep list rv rv' a lista x tcb v \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?R1918 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?G'4105 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?G'4103 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?Q3806 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Q3805 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4126 ep list rv' a lista x rv) (?S4122 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ?Q4118 badge epptr ep list rv rv' a lista x tcb b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> ?S4124 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?Q4126 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?Q4118 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?S4124 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?S4122 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4126 ep list rv' a lista x rv) (?S4122 ep list rv' a lista x rv bdg) [SKIP] (do xa <- setThreadState Structures_H.thread_state.Restart a;
y <- tcbSchedEnqueue a;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ?Q4118 badge epptr ep list rv rv' a lista x tcb b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> ?S4124 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?Q4126 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?Q4118 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?S4124 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?S4122 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4126 ep list rv' a lista x rv) (?S4122 ep list rv' a lista x rv bdg) [SKIP] (do xa <- setThreadState Structures_H.thread_state.Restart a;
y <- tcbSchedEnqueue a;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ?Q4118 badge epptr ep list rv rv' a lista x tcb b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> ?S4124 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?R1918 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Q1897 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list rv' a lista x tcb. ?Q4126 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?Q4118 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?S4124 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?S4122 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4151 badge epptr ep list rv' a lista x rv ret__unsigned rva) (?Q'4151 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) [SKIP] (do y <- tcbSchedEnqueue a;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>?Q4151 badge epptr ep list rv' a lista x rv ret__unsigned\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> ?Q'4151 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 5. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1913 badge epptr ep list\<^esub> (?R'1913 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1913 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q1897 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'1913 badge epptr ep list)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (15 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb) (?Q'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>?Q4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 7. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (15 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'4251 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb) (?Q4248 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a);;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ?P'4251 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> ?Q4248 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 7. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'1913 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?R1918 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres (?r'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) (?xf'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) (?P4263 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb) (?P'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) [SKIP] (return ()) (\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; ?r'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. ?r'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (?xf'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (?xf'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and (?P4263 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> ?P'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s) \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ((\<forall>t\<in>set (x @ a # lista). tcb_at' t \<sigma>) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' \<sigma> p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues \<sigma> \<and> distinct (x @ a # lista) \<and> pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma>) \<and> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. ((\<forall>t\<in>set (x @ a # lista). tcb_at' t \<sigma>) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' \<sigma> p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues \<sigma> \<and> distinct (x @ a # lista) \<and> pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma>) \<and> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb \<sigma>. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> {s. ((\<forall>t\<in>set (x @ a # lista). tcb_at' t \<sigma>) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' \<sigma> p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues \<sigma> \<and> distinct (x @ a # lista) \<and> pspace_aligned' \<sigma> \<and> pspace_distinct' \<sigma>) \<and> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>queue. (\<exists>t. (t, tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<in> rf_sr \<and> dc rv (xfdc (queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)))))}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>t. (t, xa) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift xa) queue (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?R4168 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?R4117 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4154 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?T4123 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>t. (t, xa) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue8594 a lista x rv \<sigma> xa). tcb_at' tcb t) \<and> distinct (?queue8594 a lista x rv \<sigma> xa) \<and> a \<in> set (?queue8594 a lista x rv \<sigma> xa) \<and> ep_queue_relation' (cslift xa) (?queue8594 a lista x rv \<sigma> xa) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))
 2. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (?queue8594 a lista x rv \<sigma> xa)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> (\<forall>tcb\<in>set (?queue8594 a lista x rv \<sigma> xa). tcb_at' tcb \<sigma>) \<and> distinct (?queue8594 a lista x rv \<sigma> xa) \<and> a \<in> set (?queue8594 a lista x rv \<sigma> xa) \<and> ep_queue_relation' (cslift xa) (?queue8594 a lista x rv \<sigma> xa) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))
 2. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (?queue8594 a lista x rv \<sigma> xa)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4152 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R4125 ep list rv' a lista x rv) (?T4120 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (22 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift xa) (?queue8594 a lista x rv \<sigma> xa) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))
 2. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> a \<in> set (?queue8594 a lista x rv \<sigma> xa)
 3. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> distinct (?queue8594 a lista x rv \<sigma> xa)
 4. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> \<forall>tcb\<in>set (?queue8594 a lista x rv \<sigma> xa). tcb_at' tcb \<sigma>
 5. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (?queue8594 a lista x rv \<sigma> xa)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue8594 a lista x rv \<sigma> xa))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
A total of 22 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (21 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> a \<in> set (x @ a # lista)
 2. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> distinct (x @ a # lista)
 3. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> \<forall>tcb\<in>set (x @ a # lista). tcb_at' tcb \<sigma>
 4. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?R4211 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4261 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4207 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4255 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?R4165 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?R4211 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R4168 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R4165 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'4154 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'4152 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list rv' a lista x tcb. ?R4125 ep list rv' a lista x (tcbState tcb) \<equiv>\<^sup>? \<lambda>ep list. ?R4117 bdg (ep_Ptr ptr) ep list ()
\<lambda>ep list. ?T4123 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4120 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa))\<rbrakk> \<Longrightarrow> a \<in> set (x @ a # lista) &&& distinct (x @ a # lista) &&& \<forall>tcb\<in>set (x @ a # lista). tcb_at' tcb \<sigma>
 2. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (1 subgoal):
 1. a_ \<in> set (x_ @ a_ # lista_) &&& distinct (x_ @ a_ # lista_) &&& \<forall>tcb\<in>set (x_ @ a_ # lista_). tcb_at' tcb \<sigma>_ proof (prove)
using this:
bdg = blockingIPCBadge rv_
tcb_at' a_ \<sigma>_
\<forall>t\<in>set x_. tcb_at' t \<sigma>_
\<forall>t\<in>set lista_. tcb_at' t \<sigma>_
\<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound)
Invariants_H.valid_queues \<sigma>_
distinct x_
a_ \<notin> set lista_
distinct lista_
a_ \<notin> set x_
set x_ \<inter> set lista_ = {}
pspace_aligned' \<sigma>_
pspace_distinct' \<sigma>_
ep_queue_relation' (cslift xa_) (x_ @ a_ # lista_) (head_C (queue_' xa_)) (StateRelation_C.end_C (queue_' xa_))

goal (1 subgoal):
 1. a_ \<in> set (x_ @ a_ # lista_) &&& distinct (x_ @ a_ # lista_) &&& \<forall>tcb\<in>set (x_ @ a_ # lista_). tcb_at' tcb \<sigma>_ proof (prove)
goal (18 subgoals):
 1. \<And>a lista x rv \<sigma> xa. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); (\<sigma>, xa) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> = cslift xa|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)) \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> cslift t = cslift xa \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)) \<longrightarrow> (\<exists>x\<in>fst (return () \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa\<lparr>globals := globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals t))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift xa
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift xa
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bdg = blockingIPCBadge rv_; tcb_at' a_ \<sigma>_; \<forall>t\<in>set x_. tcb_at' t \<sigma>_; \<forall>t\<in>set lista_. tcb_at' t \<sigma>_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; ep_queue_relation' (cslift xa_) (x_ @ a_ # lista_) (head_C (queue_' xa_)) (StateRelation_C.end_C (queue_' xa_)); cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); carch_state_relation (ksArchState \<sigma>_) (globals xa_); cmachine_state_relation (ksMachineState \<sigma>_) (globals xa_); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_; head_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); ep_queue_relation' (cslift t_) (remove1 a_ (x_ @ a_ # lista_)) (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)) (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); cslift t_|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a_) (tcb_ptr_to_ctcb_ptr ` (set x_ \<union> set lista_)))\<^esub> = cslift xa_|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a_) (tcb_ptr_to_ctcb_ptr ` (set x_ \<union> set lista_)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t_ x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa_ x)); cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t_)) = zero_ranges_are_zero rs (t_hrs_' (globals xa_)); hrs_htd (t_hrs_' (globals t_)) = hrs_htd (t_hrs_' (globals xa_)); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t_ = map_option tcb_null_ep_ptrs \<circ> cslift xa_ proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa a' b b'. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_eps (ksPSpace \<sigma>) p = Some aa; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift xa (ep_Ptr p) = Some b; cslift xa (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift xa) aa b = cendpoint_relation (cslift t) a' b'
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_eps (ksPSpace \<sigma>) p = Some aa; cslift xa (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift xa) aa b = cendpoint_relation (cslift t) aa b
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_eps (ksPSpace \<sigma>) p = Some aa; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa\<rbrakk> \<Longrightarrow> cslift xa (tcb_ptr_to_ctcb_ptr ta) = cslift t (tcb_ptr_to_ctcb_ptr ta)
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_eps (ksPSpace \<sigma>) p = Some aa; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr ta \<in> - insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_eps (ksPSpace \<sigma>) p = Some aa; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa; ko_at' aa p \<sigma>\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa; state_refs_of' \<sigma> p = refs_of' (injectKOS aa)\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa; state_refs_of' \<sigma> p = ep_q_refs_of' aa\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (20 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ep_Ptr p) = Some b; (ta, rf) \<in> ep_q_refs_of' aa; state_refs_of' \<sigma> p = ep_q_refs_of' aa; (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound)\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
A total of 20 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bdg = blockingIPCBadge rv_; tcb_at' a_ \<sigma>_; \<forall>t\<in>set x_. tcb_at' t \<sigma>_; \<forall>t\<in>set lista_. tcb_at' t \<sigma>_; Invariants_H.valid_queues \<sigma>_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; ep_queue_relation' (cslift xa_) (x_ @ a_ # lista_) (head_C (queue_' xa_)) (StateRelation_C.end_C (queue_' xa_)); cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); carch_state_relation (ksArchState \<sigma>_) (globals xa_); cmachine_state_relation (ksMachineState \<sigma>_) (globals xa_); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_; head_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); ep_queue_relation' (cslift t_) (remove1 a_ (x_ @ a_ # lista_)) (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)) (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t_ x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa_ x)); cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t_)) = zero_ranges_are_zero rs (t_hrs_' (globals xa_)); hrs_htd (t_hrs_' (globals t_)) = hrs_htd (t_hrs_' (globals xa_)); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift xa_) ntfn_Ptr (cnotification_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cslift xa_ (ep_Ptr p_) = Some b_; (ta_, rf_) \<in> ep_q_refs_of' aa_; state_refs_of' \<sigma>_ p_ = ep_q_refs_of' aa_; (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound)\<rbrakk> \<Longrightarrow> ta_ \<noteq> a_ \<and> ta_ \<notin> set x_ \<and> ta_ \<notin> set lista_ proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift xa) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa a' b b'. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift xa (ntfn_Ptr p) = Some b; cslift xa (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift xa) aa b = cnotification_relation (cslift t) a' b'
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some aa; cslift xa (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift xa) aa b = cnotification_relation (cslift t) aa b
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ntfn_Ptr p) = Some b; state_refs_of' \<sigma> p = refs_of' (injectKOS aa)\<rbrakk> \<Longrightarrow> cnotification_relation (cslift xa) aa b = cnotification_relation (cslift t) aa b
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ntfn_Ptr p) = Some b; state_refs_of' \<sigma> p = refs_of' (injectKOS aa); (ta, rf) \<in> ntfn_q_refs_of' (ntfnObj aa)\<rbrakk> \<Longrightarrow> cslift xa (tcb_ptr_to_ctcb_ptr ta) = cslift t (tcb_ptr_to_ctcb_ptr ta)
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ntfn_Ptr p) = Some b; state_refs_of' \<sigma> p = refs_of' (injectKOS aa); (ta, rf) \<in> ntfn_q_refs_of' (ntfnObj aa)\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr ta \<in> - insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista))
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ntfn_Ptr p) = Some b; state_refs_of' \<sigma> p = ntfn_q_refs_of' (ntfnObj aa) \<union> ntfn_bound_refs' (ntfnBoundTCB aa); (ta, rf) \<in> ntfn_q_refs_of' (ntfnObj aa)\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t p aa b ta rf. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa)); cmap_relation (ctes_of \<sigma>) (cslift xa) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift xa) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift xa) ep_Ptr (cendpoint_relation (cslift xa)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift xa) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift xa) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift xa) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift xa) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid xa) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid xa) pt_Ptr; cslift xa (ntfn_Ptr p) = Some b; state_refs_of' \<sigma> p = ntfn_q_refs_of' (ntfnObj aa) \<union> ntfn_bound_refs' (ntfnBoundTCB aa); (ta, rf) \<in> ntfn_q_refs_of' (ntfnObj aa); (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound)\<rbrakk> \<Longrightarrow> ta \<noteq> a \<and> ta \<notin> set x \<and> ta \<notin> set lista
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bdg = blockingIPCBadge rv_; tcb_at' a_ \<sigma>_; \<forall>t\<in>set x_. tcb_at' t \<sigma>_; \<forall>t\<in>set lista_. tcb_at' t \<sigma>_; Invariants_H.valid_queues \<sigma>_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; pspace_aligned' \<sigma>_; pspace_distinct' \<sigma>_; ep_queue_relation' (cslift xa_) (x_ @ a_ # lista_) (head_C (queue_' xa_)) (StateRelation_C.end_C (queue_' xa_)); cready_queues_relation (cslift xa_) (ksReadyQueues_' (globals xa_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals xa_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals xa_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals xa_)); carch_state_relation (ksArchState \<sigma>_) (globals xa_); cmachine_state_relation (ksMachineState \<sigma>_) (globals xa_); cte_array_relation \<sigma>_ (globals xa_); tcb_cte_array_relation \<sigma>_ (globals xa_); apsnd fst (ghost'state_' (globals xa_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals xa_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals xa_) = ksWorkUnitsCompleted \<sigma>_; xa_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals xa_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals xa_) = ksDomainTime \<sigma>_; head_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); ep_queue_relation' (cslift t_) (remove1 a_ (x_ @ a_ # lista_)) (if tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' xa_)) (if tcbEPNext_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift xa_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' xa_)); (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t_ x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa_ x)); cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; cslift t_ = cslift xa_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t_)) = zero_ranges_are_zero rs (t_hrs_' (globals xa_)); hrs_htd (t_hrs_' (globals t_)) = hrs_htd (t_hrs_' (globals xa_)); cmap_relation (ctes_of \<sigma>_) (cslift xa_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift xa_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift xa_) ep_Ptr (cendpoint_relation (cslift xa_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift xa_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift xa_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift xa_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift xa_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid xa_) pt_Ptr; cslift xa_ (ntfn_Ptr p_) = Some b_; state_refs_of' \<sigma>_ p_ = ntfn_q_refs_of' (ntfnObj aa_) \<union> ntfn_bound_refs' (ntfnBoundTCB aa_); (ta_, rf_) \<in> ntfn_q_refs_of' (ntfnObj aa_); (\<forall>rf. (a_, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista_. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma>_ p_ \<longrightarrow> rf = NTFNBound)\<rbrakk> \<Longrightarrow> ta_ \<noteq> a_ \<and> ta_ \<notin> set x_ \<and> ta_ \<notin> set lista_ proof (prove)
goal (18 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>)
 2. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>a lista x rv \<sigma> xa t. \<lbrakk>bdg = blockingIPCBadge rv; tcb_at' a \<sigma>; \<forall>t\<in>set x. tcb_at' t \<sigma>; \<forall>t\<in>set lista. tcb_at' t \<sigma>; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' \<sigma> p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues \<sigma>; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; pspace_aligned' \<sigma>; pspace_distinct' \<sigma>; ep_queue_relation' (cslift xa) (x @ a # lista) (head_C (queue_' xa)) (StateRelation_C.end_C (queue_' xa)); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals xa)); cready_queues_relation (cslift xa) (ksReadyQueues_' (globals xa)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals xa)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals xa)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals xa)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals xa) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals xa)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals xa)); carch_state_relation (ksArchState \<sigma>) (globals xa); cmachine_state_relation (ksMachineState \<sigma>) (globals xa); cte_array_relation \<sigma> (globals xa); tcb_cte_array_relation \<sigma> (globals xa); apsnd fst (ghost'state_' (globals xa)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals xa)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals xa) = ksWorkUnitsCompleted \<sigma>; xa \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; xa \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals xa))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals xa) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals xa) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals xa) = ksDomainTime \<sigma>; head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (if tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' xa)) (if tcbEPNext_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift xa (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' xa)); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift xa|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift xa x)); cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; cslift t = cslift xa; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals xa)); hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals xa))\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals xa\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (17 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 9. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 10. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (19 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_) (?Q'168 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) (?Q'168 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F168 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>?Q4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 10. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
A total of 19 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (18 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a) \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F168 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>\<lambda>a b. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> ?Q'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 9. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 10. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (17 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb; dc uu_ rv'a\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F168 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb uu_ rv'a\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>\<lambda>a b. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 8. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 9. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 10. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (16 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<lbrace>?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb\<rbrace> return () \<lbrace>\<lambda>a b. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b\<rbrace>
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and ?R4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca b)\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 7. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 8. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 9. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 10. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
A total of 16 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (15 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb\<^esub> (?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>uu_. dc uu_ (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and (\<lambda>a. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' a p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a))\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 7. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (15 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned xfdca xfdcb. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4 bdg (ep_Ptr ptr) ep list rv' a lista x rv bdg () xfdca () xfdcb\<^esub> (?R'4 bdg (ep_Ptr ptr) ep list rv' a lista x rv bdg () xfdca () xfdcb) \<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a) {s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and (\<lambda>a. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' a p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a))\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t sa) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> ?R'4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca rvb (xfdc s)}}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 6. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 7. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 8. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 9. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
A total of 15 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (14 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<lbrace>?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned rva\<rbrace> tcbSchedEnqueue a \<lbrace>\<lambda>b. (\<lambda>s. \<forall>t\<in>set (x @ a # lista). tcb_at' t s) and ((\<lambda>b. (\<forall>t\<in>set (x @ a # lista). tcb_at' t b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b) and (\<lambda>a. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' a p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a))\<rbrace>
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t s) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> {s. \<exists>queue. (\<exists>t. (t, tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))}}}
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and ?Ra4 badge epptr ep list rv' a lista x rv ret__unsigned b\<rbrace>
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 5. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 6. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 7. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 8. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
A total of 14 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (\<forall>t\<in>set (x @ a # lista). tcb_at' t s) \<longrightarrow> s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> {s. \<exists>queue. (\<exists>t. (t, tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))}}}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and (\<lambda>b. (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 5. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (13 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned xfdca. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'a4 bdg (ep_Ptr ptr) ep list rv' a lista x rv bdg () xfdca) CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a) {s. (\<exists>sa. (sa, s) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>t. (t, s) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift s) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s))))}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and (\<lambda>b. (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)\<rbrace>
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'a4 badge epptr ep list rv' a lista x rv ret__unsigned rva (xfdc s)}
 4. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 5. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (12 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<lbrace>?Rb4 ep list rv' a lista x rv\<rbrace> setThreadState Structures_H.thread_state.Restart a \<lbrace>\<lambda>b. Invariants_H.valid_queues and tcb_at' a and valid_objs' and (\<lambda>b. (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> state_refs_of' b p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues and st_tcb_at' runnable' a and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)\<rbrace>
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>ta. (ta, s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift t) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>ta. head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift ta) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' ta)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta)) \<and> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals t))) \<and> hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ lista) (if tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))}}
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 4. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and ?Rd4 badge epptr ep list rv rv' a lista x tcb) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 5. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 6. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 10. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Rd4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rb4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = bdg; blockingIPCBadge rv = bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'b4 ep list rv' a lista x rv bdg) CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s \<in> UNIV \<inter> \<lbrace>\<acute>tcb = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>ta. (ta, s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift t) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>ta. head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift ta) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' ta)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta)) \<and> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> cslift ta = cslift t \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals t))) \<and> hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals t)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ lista) (if tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift t (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))}}
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> ?R'c4 badge epptr ep list rv rv' a lista x tcb v) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list. ?R'c4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?R'b4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv ret__unsigned) [SKIP] (do b <- return True;
ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ (if b then a # ys else ys) of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (IF ret__unsigned = bdg THEN
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr a,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(tcb_ptr_to_ctcb_ptr a);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr a,\<acute>queue)
FI;;
(\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?T4 ep list rv' a lista x rv (blockingIPCBadge rv)) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ a # ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (\<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v);;
(While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))))
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (12 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Rc4 ep list rv' a lista x rv) (?Q'680 badge epptr ep list rv' a lista x rv ret__unsigned) [SKIP] (do ys <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ a # ys of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc())))
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?T4 ep list rv' a lista x rv (blockingIPCBadge rv)) \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) (?Q'680 badge epptr ep list rv' a lista x rv ret__unsigned)
 3. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F680 badge epptr ep list rv' a lista x rv ret__unsigned\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 4. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> ?Re4 badge epptr ep list rv rv' a lista x tcb b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 5. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 6. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 10. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Re4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?Rc4 ep list rv' a lista x (tcbState tcb)
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (11 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?T4 ep list rv' a lista x rv (blockingIPCBadge rv)) \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) ({s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 2. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F680 badge epptr ep list rv' a lista x rv ret__unsigned\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 3. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> a \<notin> set x \<and> distinct lista \<and> a \<notin> set lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound)) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> ?Ta4 badge epptr ep list rv rv' a lista x tcb v)} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
A total of 11 subgoals...
flex-flex pairs:
\<lambda>ep list. ?Ta4 bdg (ep_Ptr ptr) ep list () \<equiv>\<^sup>? \<lambda>ep list rv' a lista x tcb. ?T4 ep list rv' a lista x (tcbState tcb) proof (prove)
goal (10 subgoals):
 1. \<And>badge epptr ep list rv' a lista x rv ret__unsigned. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
y <- setEndpoint ptr (case x @ zs of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); ret__unsigned = blockingIPCBadge rv; blockingIPCBadge rv \<noteq> bdg\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/?F680 badge epptr ep list rv' a lista x rv ret__unsigned\<^esub> {s} \<acute>thread :== (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) {t. t may_not_modify_globals s}
 2. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> a \<notin> set x \<and> distinct lista \<and> a \<notin> set lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound)) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)})} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; \<forall>x. ccorres dc xfdc (\<lambda>s. (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) ({s. ep_queue_relation' (cslift s) (x @ lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>) [SKIP] (do queue' <- do zs <- filterM (\<lambda>a. do st <- getThreadState a;
if blockingIPCBadge st = bdg then do setThreadState Structures_H.thread_state.Restart a;
tcbSchedEnqueue a;
return False
od else return True
od) lista;
return (x @ zs)
od;
y <- setEndpoint ptr (case queue' of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.SendEP (a # list));
rescheduleRequired
od) (While \<lbrace>\<acute>thread \<noteq> NULL\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCBadge_'proc(PTR(thread_state_C) &(\<acute>thread\<rightarrow>[''tcbState_C''])));;
\<acute>b :== \<acute>ret__unsigned;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>next___ptr_to_struct_tcb_C :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])));;
IF \<acute>b = bdg THEN
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>thread,\<acute>queue)
FI;;
\<acute>thread :== \<acute>next___ptr_to_struct_tcb_C);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr ptr,\<acute>queue);;
(IF head_C \<acute>queue \<noteq> NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Send)
FI;;
CALL rescheduleRequired_'proc()))); (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> a \<notin> set x \<and> distinct lista \<and> a \<notin> set lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound)) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)})} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>badge epptr ep list rv rv' a lista x s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (s, s') \<in> rf_sr; (\<forall>x\<in>set x \<union> set (a # lista). st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct (x @ a # lista) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set (x @ a # lista). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s; s' \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> ((\<lambda>_. True) and (\<lambda>b. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> ((\<lambda>b. tcb_at' a b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Restart b \<and> (ksSchedulerAction b = SwitchToThread a \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. a \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction b) b) and (\<lambda>b. (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> tcb_at' a b \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>x\<in>set (x @ a # lista). tcb_at' x b) \<and> (\<forall>p. \<forall>t\<in>set (x @ a # lista). \<forall>rf. (t, rf) \<notin> {r \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p. snd r \<noteq> NTFNBound}) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> distinct (x @ a # lista) \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> (\<forall>x\<in>set x \<union> set lista. (a = x \<longrightarrow> (isBlockedOnSend Structures_H.thread_state.Restart \<and> blockingObject Structures_H.thread_state.Restart = ptr) \<and> tcb_at' x b) \<and> (a \<noteq> x \<longrightarrow> st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x b)) \<and> distinct x \<and> distinct lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. \<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> ((state_refs_of' b)(a := tcb_st_refs_of' Structures_H.thread_state.Restart \<union> {r \<in> state_refs_of' b a. snd r = TCBBound})) p \<longrightarrow> rf = NTFNBound) \<and> (Invariants_H.valid_queues b \<and> ((\<exists>p. a \<in> set (ksReadyQueues b p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart)) \<and> ((a = a \<longrightarrow> runnable' Structures_H.thread_state.Restart \<and> tcb_at' a b) \<and> (a \<noteq> a \<longrightarrow> st_tcb_at' runnable' a b)) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> ((\<not> runnable' Structures_H.thread_state.Restart \<longrightarrow> sch_act_simple b) \<and> sch_act_wf (ksSchedulerAction b) b) \<and> (valid_tcb_state' Structures_H.thread_state.Restart and valid_objs') b)) b) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a b \<and> (\<forall>x\<in>set x \<union> set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x b) \<and> distinct x \<and> a \<notin> set x \<and> distinct lista \<and> a \<notin> set lista \<and> set x \<inter> set lista = {} \<and> ko_at' Structures_H.endpoint.IdleEP ptr b \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x \<union> set lista. \<forall>rf. (x, rf) \<in> state_refs_of' b p \<longrightarrow> rf = NTFNBound)) \<and> Invariants_H.valid_queues b \<and> pspace_aligned' b \<and> pspace_distinct' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> valid_objs' b)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a)) and tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr a))) s) \<and> s' \<in> {s'. \<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> s' \<in> {s. \<forall>v v'. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s) (cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s (tcb_ptr_to_ctcb_ptr a)))))} \<longrightarrow> s \<in> {s. b_'_update (\<lambda>_. v) s \<in> {s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))}. s\<lparr>next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr> \<in> {s. (blockingIPCBadge (tcbState tcb) = badge \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr a) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr a\<rbrace>} \<inter> {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s) = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s) \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s) (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s) (head_C (ksReadyQueues_' (globals s).[unat (d * 0x100 + v)])) \<noteq> None)) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s) \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s) \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s) \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s) \<longrightarrow> (\<exists>sa. (sa, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a sa \<and> (\<forall>t\<in>set x \<union> set lista. tcb_at' t sa)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (\<exists>queue. (\<exists>tb. (tb, s\<lparr>globals := globals s\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' s)) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' s)))))))}) \<and> (blockingIPCBadge (tcbState tcb) \<noteq> badge \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) (x @ a # lista) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> (case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v) = (case lista of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)})} \<inter> \<lbrace>v = blockingIPCBadge (tcbState tcb)\<rbrace>} \<inter> \<lbrace>True\<rbrace>}}}} \<inter> {s. thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s \<Turnstile>\<^sub>c cparent (thread_state_ptr_' (thread_state_ptr_'_update (\<lambda>_. PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr a\<rightarrow>[''tcbState_C''])) s)) [''tcbState_C'']} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>tcb_ptr_to_ctcb_ptr a \<noteq> NULL\<rbrace>
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s'. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<forall>tcb. ko_at' tcb a s \<longrightarrow> blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound)) \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>p. (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound)) \<and> valid_tcb_state' Structures_H.thread_state.Restart s) \<and> (\<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a) \<and> tcb_ptr_to_ctcb_ptr a \<noteq> NULL
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s'. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> \<forall>tcb. ko_at' tcb a s \<longrightarrow> blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>p. (\<forall>rf. (a, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound)) \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>p. (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> (if p = a then {r \<in> state_refs_of' s a. snd r = TCBBound} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound)) \<and> valid_tcb_state' Structures_H.thread_state.Restart s
 2. \<And>a lista x s s'. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a) \<and> tcb_ptr_to_ctcb_ptr a \<noteq> NULL
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; ko_at' tcb a s; bdg = blockingIPCBadge (tcbState tcb)\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> (\<forall>x\<in>set lista. tcb_at' x s) \<and> (\<forall>rf. (a, rf) \<in> state_refs_of' s a \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>t\<in>set x. \<forall>rf. (t, rf) \<in> state_refs_of' s a \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>t\<in>set lista. \<forall>rf. (t, rf) \<in> state_refs_of' s a \<longrightarrow> rf \<noteq> TCBBound) \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s a \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s a \<longrightarrow> rf \<noteq> TCBBound) \<and> valid_tcb_state' Structures_H.thread_state.Restart s
 2. \<And>a lista x s s'. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a) \<and> tcb_ptr_to_ctcb_ptr a \<noteq> NULL
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a_ s_; \<forall>x\<in>set x_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s_; \<forall>x\<in>set lista_. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP ptr s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; sch_act_wf (ksSchedulerAction s_) s_; valid_objs' s_; ko_at' tcb_ a_ s_; bdg = blockingIPCBadge (tcbState tcb_)\<rbrakk> \<Longrightarrow> valid_tcb_state' Structures_H.thread_state.Restart s_ \<and> (\<forall>x\<in>set x_. tcb_at' x s_) \<and> (\<forall>x\<in>set lista_. tcb_at' x s_) \<and> (\<forall>x\<in>set x_. tcb_at' x s_) \<and> (\<forall>x\<in>set lista_. tcb_at' x s_) \<and> (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ a_ \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>t\<in>set x_. \<forall>rf. (t, rf) \<in> state_refs_of' s_ a_ \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>t\<in>set lista_. \<forall>rf. (t, rf) \<in> state_refs_of' s_ a_ \<longrightarrow> rf \<noteq> TCBBound) \<and> valid_tcb_state' Structures_H.thread_state.Restart s_ \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ a_ \<longrightarrow> rf \<noteq> TCBBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ a_ \<longrightarrow> rf \<noteq> TCBBound) \<and> valid_tcb_state' Structures_H.thread_state.Restart s_ proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s'. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s\<rbrakk> \<Longrightarrow> (\<forall>tcb ctcb. cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb \<and> ctcb_relation tcb ctcb \<longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a) \<and> tcb_ptr_to_ctcb_ptr a \<noteq> NULL
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) a s; \<forall>x\<in>set x. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; \<forall>x\<in>set lista. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb\<rbrakk> \<Longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb) \<and> s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr a
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) a s; \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb\<rbrakk> \<Longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb)
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP ptr s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; \<exists>ko ko'. ko_at' ko a s \<and> ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) \<circ> tcbState) ko \<and> cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> (blockingIPCBadge (tcbState tcb) = bdg \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))) \<and> blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)) = blockingIPCBadge (tcbState tcb)
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> (\<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))) \<and> (\<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>x. ksSchedulerAction_' (globals s') = tcb_Ptr x \<and> x \<noteq> 0 \<and> x \<noteq> 1 \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr x) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr x) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y)))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_Ptr xa; xa \<noteq> 0; xa \<noteq> 1\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr xa) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr xa) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_Ptr xa; xa \<noteq> 0; xa \<noteq> 1; cscheduler_action_relation (ksSchedulerAction s) (ksSchedulerAction_' (globals s'))\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_Ptr xa) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_Ptr xa) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa x3. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr x3; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread x3; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr x3; obj_at' (runnable' \<circ> tcbState) x3 s; tcb_in_cur_domain' x3 s\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr x3) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr x3) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (13 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> obj_at' (?P819 a lista x s s' tcb ctcb ko xa word) word s
 2. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s
 3. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> valid_objs' s
 4. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s; \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 5. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 6. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 7. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 10. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s
 2. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> valid_objs' s
 3. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s; \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 4. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 5. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 6. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 9. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 10. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); ksSchedulerAction_' (globals s'_) = tcb_ptr_to_ctcb_ptr word_; xa_ \<noteq> 0; xa_ \<noteq> 1; ksSchedulerAction s_ = SwitchToThread word_; tcb_Ptr xa_ = tcb_ptr_to_ctcb_ptr word_; obj_at' (runnable' \<circ> tcbState) word_ s_; tcb_in_cur_domain' word_ s_\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s_ proof (prove)
goal (11 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s; \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 3. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 4. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 5. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 8. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 9. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 10. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); ksSchedulerAction_' (globals s'_) = tcb_ptr_to_ctcb_ptr word_; xa_ \<noteq> 0; xa_ \<noteq> 1; ksSchedulerAction s_ = SwitchToThread word_; tcb_Ptr xa_ = tcb_ptr_to_ctcb_ptr word_; obj_at' (runnable' \<circ> tcbState) word_ s_; tcb_in_cur_domain' word_ s_\<rbrakk> \<Longrightarrow> valid_objs' s_ proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko xa word. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); ksSchedulerAction_' (globals s') = tcb_ptr_to_ctcb_ptr word; xa \<noteq> 0; xa \<noteq> 1; ksSchedulerAction s = SwitchToThread word; tcb_Ptr xa = tcb_ptr_to_ctcb_ptr word; obj_at' (runnable' \<circ> tcbState) word s; tcb_in_cur_domain' word s; \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr word) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); ksSchedulerAction_' (globals s'_) = tcb_ptr_to_ctcb_ptr word_; xa_ \<noteq> 0; xa_ \<noteq> 1; ksSchedulerAction s_ = SwitchToThread word_; tcb_Ptr xa_ = tcb_ptr_to_ctcb_ptr word_; obj_at' (runnable' \<circ> tcbState) word_ s_; tcb_in_cur_domain' word_ s_; \<exists>d v. option_map2 tcbPriority_C (cslift s'_) (tcb_ptr_to_ctcb_ptr word_) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s'_) (tcb_ptr_to_ctcb_ptr word_) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s'_) (tcb_ptr_to_ctcb_ptr word_) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s'_) (tcb_ptr_to_ctcb_ptr word_) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) = Some y)) proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb))\<rbrakk> \<Longrightarrow> \<forall>t. option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s') \<and> ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s') \<longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s')\<rbrakk> \<Longrightarrow> (\<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))) \<and> (\<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s')\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s')\<rbrakk> \<Longrightarrow> \<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s') (tcb_ptr_to_ctcb_ptr a) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s') (head_C (ksReadyQueues_' (globals s').[unat (d * 0x100 + v)])) = Some y))
 2. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s')\<rbrakk> \<Longrightarrow> \<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; sch_act_wf (ksSchedulerAction s_) s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); option_map2 tcbEPNext_C (cslift t_) = option_map2 tcbEPNext_C (cslift s'_); option_map2 tcbEPPrev_C (cslift t_) = option_map2 tcbEPPrev_C (cslift s'_); option_map2 tcbPriority_C (cslift t_) = option_map2 tcbPriority_C (cslift s'_); option_map2 tcbDomain_C (cslift t_) = option_map2 tcbDomain_C (cslift s'_); ksReadyQueues_' (globals t_) = ksReadyQueues_' (globals s'_); \<exists>d v. option_map2 tcbPriority_C (cslift s'_) (tcb_ptr_to_ctcb_ptr a_) = Some v \<and> unat v < Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s'_) (tcb_ptr_to_ctcb_ptr a_) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> option_map2 tcbPriority_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) \<noteq> None \<and> option_map2 tcbDomain_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) \<noteq> None)\<rbrakk> \<Longrightarrow> \<exists>d v. option_map2 tcbPriority_C (cslift s'_) (tcb_ptr_to_ctcb_ptr a_) = Some v \<and> unat v \<le> Config_H.numPriorities \<and> option_map2 tcbDomain_C (cslift s'_) (tcb_ptr_to_ctcb_ptr a_) = Some d \<and> unat d < numDomains \<and> (StateRelation_C.end_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)]) \<noteq> NULL \<longrightarrow> (\<exists>y. option_map2 tcbPriority_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) = Some y) \<and> (\<exists>y. option_map2 tcbDomain_C (cslift s'_) (head_C (ksReadyQueues_' (globals s'_).[unat (d * 0x100 + v)])) = Some y)) proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s')\<rbrakk> \<Longrightarrow> \<forall>ta. option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s') \<and> option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s') \<and> option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s') \<longrightarrow> (\<exists>s. (s, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a s \<and> (\<forall>t\<in>set x. tcb_at' t s) \<and> (\<forall>t\<in>set lista. tcb_at' t s)) \<longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')) \<and> (\<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))
 2. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; StateRelation_C.end_C (queue_' s') = tcb_ptr_to_ctcb_ptr (if lista = [] then a else last lista); ep_queue_relation (cslift s') (x @ a # lista) NULL (head_C (queue_' s'))\<rbrakk> \<Longrightarrow> ep_queue_relation (cslift ta) (x @ a # lista) NULL (head_C (queue_' s'))
 2. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; StateRelation_C.end_C (queue_' s') = tcb_ptr_to_ctcb_ptr (if lista = [] then a else last lista)\<rbrakk> \<Longrightarrow> option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s') \<and> option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s')
 2. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 3. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 4. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 7. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 8. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 9. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 10. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; sch_act_wf (ksSchedulerAction s_) s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); option_map2 tcbEPNext_C (cslift t_) = option_map2 tcbEPNext_C (cslift s'_); option_map2 tcbEPPrev_C (cslift t_) = option_map2 tcbEPPrev_C (cslift s'_); option_map2 tcbPriority_C (cslift t_) = option_map2 tcbPriority_C (cslift s'_); option_map2 tcbDomain_C (cslift t_) = option_map2 tcbDomain_C (cslift s'_); ksReadyQueues_' (globals t_) = ksReadyQueues_' (globals s'_); option_map2 tcbEPNext_C (cslift ta_) = option_map2 tcbEPNext_C (cslift s'_); option_map2 tcbEPPrev_C (cslift ta_) = option_map2 tcbEPPrev_C (cslift s'_); option_map2 tcbPriority_C (cslift ta_) = option_map2 tcbPriority_C (cslift s'_); option_map2 tcbDomain_C (cslift ta_) = option_map2 tcbDomain_C (cslift s'_); (sa_, s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'_\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t_), ksReadyQueues_' := ksReadyQueues_' (globals ta_), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta_), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta_), t_hrs_' := t_hrs_' (globals ta_)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a_ sa_; \<forall>t\<in>set x_. tcb_at' t sa_; \<forall>t\<in>set lista_. tcb_at' t sa_; StateRelation_C.end_C (queue_' s'_) = tcb_ptr_to_ctcb_ptr (if lista_ = [] then a_ else last lista_)\<rbrakk> \<Longrightarrow> option_map2 tcbEPNext_C (cslift ta_) = option_map2 tcbEPNext_C (cslift s'_) \<and> option_map2 tcbEPPrev_C (cslift ta_) = option_map2 tcbEPPrev_C (cslift s'_) proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb tb) \<and> distinct queue \<and> a \<in> set queue \<and> ep_queue_relation' (cslift ta) queue (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> (\<forall>tcb\<in>set (x @ a # lista). tcb_at' tcb tb) \<and> distinct (x @ a # lista) \<and> a \<in> set (x @ a # lista) \<and> ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> = cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (x @ a # lista))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> (\<exists>tb. (tb, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> tcb_at' a tb \<and> (\<forall>tcb\<in>set x. tcb_at' tcb tb) \<and> (\<forall>tcb\<in>set lista. tcb_at' tcb tb)) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift ta|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>a lista x s s' tcb ctcb ko t ta sa. \<lbrakk>(s, s') \<in> rf_sr; ep_queue_relation' (cslift s') (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s')); \<forall>x\<in>set x. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; \<forall>x\<in>set lista. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko)) \<circ> tcbState) x s; distinct x; a \<notin> set lista; distinct lista; a \<notin> set x; set x \<inter> set lista = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko)) s; \<forall>p. (\<forall>rf. (a, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s; pspace_aligned' s; pspace_distinct' s; sch_act_wf (ksSchedulerAction s) s; valid_objs' s; cslift s' (tcb_ptr_to_ctcb_ptr a) = Some ctcb; ctcb_relation tcb ctcb; ko_at' ko a s; isBlockedOnSend (tcbState ko); ctcb_relation ko ctcb; ptr = blockingObject (tcbState ko); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)); option_map2 tcbEPNext_C (cslift t) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift t) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift t) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift t) = option_map2 tcbDomain_C (cslift s'); ksReadyQueues_' (globals t) = ksReadyQueues_' (globals s'); option_map2 tcbEPNext_C (cslift ta) = option_map2 tcbEPNext_C (cslift s'); option_map2 tcbEPPrev_C (cslift ta) = option_map2 tcbEPPrev_C (cslift s'); option_map2 tcbPriority_C (cslift ta) = option_map2 tcbPriority_C (cslift s'); option_map2 tcbDomain_C (cslift ta) = option_map2 tcbDomain_C (cslift s'); (sa, s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb)), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a sa; \<forall>t\<in>set x. tcb_at' t sa; \<forall>t\<in>set lista. tcb_at' t sa; ep_queue_relation' (cslift ta) (x @ a # lista) (head_C (queue_' s')) (StateRelation_C.end_C (queue_' s'))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a (x @ a # lista)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> = cslift ta|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a) (tcb_ptr_to_ctcb_ptr ` (set x \<union> set lista)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> cslift t = cslift ta \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta)) \<longrightarrow> ep_queue_relation' (cslift t) (x @ lista) (if tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else head_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) = NULL then tcbEPPrev_C (the (cslift ta (tcb_ptr_to_ctcb_ptr a))) else StateRelation_C.end_C (queue_' (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s' (tcb_ptr_to_ctcb_ptr a)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a))))), next___ptr_to_struct_tcb_C_' := case lista of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>)))
 2. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 3. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 6. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 7. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 8. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 9. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; ep_queue_relation' (cslift s'_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_)); \<forall>x\<in>set x_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; \<forall>x\<in>set lista_. obj_at' ((\<lambda>st. isBlockedOnSend st \<and> blockingObject st = blockingObject (tcbState ko_)) \<circ> tcbState) x s_; distinct x_; a_ \<notin> set lista_; distinct lista_; a_ \<notin> set x_; set x_ \<inter> set lista_ = {}; ko_at' Structures_H.endpoint.IdleEP (blockingObject (tcbState ko_)) s_; \<forall>p. (\<forall>rf. (a_, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set x_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound) \<and> (\<forall>x\<in>set lista_. \<forall>rf. (x, rf) \<in> state_refs_of' s_ p \<longrightarrow> rf = NTFNBound); Invariants_H.valid_queues s_; pspace_aligned' s_; pspace_distinct' s_; sch_act_wf (ksSchedulerAction s_) s_; valid_objs' s_; cslift s'_ (tcb_ptr_to_ctcb_ptr a_) = Some ctcb_; ctcb_relation tcb_ ctcb_; ko_at' ko_ a_ s_; isBlockedOnSend (tcbState ko_); ctcb_relation ko_ ctcb_; ptr = blockingObject (tcbState ko_); bdg = blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)); option_map2 tcbEPNext_C (cslift t_) = option_map2 tcbEPNext_C (cslift s'_); option_map2 tcbEPPrev_C (cslift t_) = option_map2 tcbEPPrev_C (cslift s'_); option_map2 tcbPriority_C (cslift t_) = option_map2 tcbPriority_C (cslift s'_); option_map2 tcbDomain_C (cslift t_) = option_map2 tcbDomain_C (cslift s'_); ksReadyQueues_' (globals t_) = ksReadyQueues_' (globals s'_); option_map2 tcbEPNext_C (cslift ta_) = option_map2 tcbEPNext_C (cslift s'_); option_map2 tcbEPPrev_C (cslift ta_) = option_map2 tcbEPPrev_C (cslift s'_); option_map2 tcbPriority_C (cslift ta_) = option_map2 tcbPriority_C (cslift s'_); option_map2 tcbDomain_C (cslift ta_) = option_map2 tcbDomain_C (cslift s'_); (sa_, s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C ctcb_)), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v, globals := globals s'_\<lparr>ksSchedulerAction_' := ksSchedulerAction_' (globals t_), ksReadyQueues_' := ksReadyQueues_' (globals ta_), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta_), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta_), t_hrs_' := t_hrs_' (globals ta_)\<rparr>\<rparr>) \<in> rf_sr; tcb_at' a_ sa_; \<forall>t\<in>set x_. tcb_at' t sa_; \<forall>t\<in>set lista_. tcb_at' t sa_; ep_queue_relation' (cslift ta_) (x_ @ a_ # lista_) (head_C (queue_' s'_)) (StateRelation_C.end_C (queue_' s'_))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a_))))), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a_))))), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) \<and> ep_queue_relation' (cslift t) (remove1 a_ (x_ @ a_ # lista_)) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a_) (tcb_ptr_to_ctcb_ptr ` (set x_ \<union> set lista_)))\<^esub> = cslift ta_|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr a_) (tcb_ptr_to_ctcb_ptr ` (set x_ \<union> set lista_)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> cslift t = cslift ta_ \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals ta_))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals ta_)) \<longrightarrow> ep_queue_relation' (cslift t) (x_ @ lista_) (if tcbEPPrev_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPNext_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) else head_C (queue_' (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a_))))), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) (if tcbEPNext_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) = NULL then tcbEPPrev_C (the (cslift ta_ (tcb_ptr_to_ctcb_ptr a_))) else StateRelation_C.end_C (queue_' (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_))))), b_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift (s'_\<lparr>ret__unsigned_' := blockingIPCBadge_CL (thread_state_lift (tcbState_C (the (cslift s'_ (tcb_ptr_to_ctcb_ptr a_)))))\<rparr>) (tcb_ptr_to_ctcb_ptr a_))))), next___ptr_to_struct_tcb_C_' := case lista_ of [] \<Rightarrow> NULL | v # vs \<Rightarrow> tcb_ptr_to_ctcb_ptr v\<rparr>))) proof (prove)
goal (8 subgoals):
 1. \<And>badge epptr ep list rv rv'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv') \<acute>thread :== head_C \<acute>queue ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s))} \<inter> \<lbrace>\<acute>thread = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)\<rbrace>)
 2. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'a4 badge epptr ep list rv rv' \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'a4 badge epptr ep list rv (xfdc s)}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== head_C \<acute>queue {s'. (s, s') \<in> rf_sr}
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 5. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 7. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>badge epptr ep list rv rv' s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; dc rv rv'; (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x s) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrakk> \<Longrightarrow> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. (s, thread_'_update (\<lambda>_. head_C (queue_' sa)) sa) \<in> rf_sr}
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 5. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 6. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 7. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?Rf4 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = ptr) x a) \<and> distinct ([] @ list) \<and> ko_at' Structures_H.endpoint.IdleEP ptr a \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' a p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a\<rbrace>
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 4. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and ?Rf4 bdg (ep_Ptr ptr) ep list) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 6. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and ?Rf4 badge epptr ep x)) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?P'904 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv s. ko_at' Structures_H.endpoint.IdleEP ptr s \<and> (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 4. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> ?P'904 bdg (ep_Ptr ptr) ep list a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 6. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> ?P'904 badge epptr ep x a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>badge epptr ep list ko s x y n. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> updateObject Structures_H.endpoint.IdleEP ko ptr y n s = updateObject_default Structures_H.endpoint.IdleEP ko ptr y n s
 2. \<And>badge epptr ep list v. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?P'912 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv s. (\<forall>p. \<forall>x\<in>set ([] @ list). \<forall>rf. (x, rf) \<notin> {r \<in> state_refs_of' s p. snd r \<noteq> NTFNBound}) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 4. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 5. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 6. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> ?P'912 bdg (ep_Ptr ptr) ep list a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 7. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 8. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> ?P'912 badge epptr ep x a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<lbrace>?P'912 bdg (ep_Ptr ptr) ep list\<rbrace> setEndpoint ptr Structures_H.endpoint.IdleEP \<lbrace>\<lambda>rv s. (\<forall>p. \<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> state_refs_of' s p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 3. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 4. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> ?P'912 bdg (ep_Ptr ptr) ep list a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 5. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 6. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> ?P'912 badge epptr ep x a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Fa4 badge epptr ep list\<^esub> (?R'd4 badge epptr ep list) CALL endpoint_ptr_set_state_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle);;
CALL endpoint_ptr_set_epQueue_head_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL endpoint_ptr_set_epQueue_tail_'proc(ep_Ptr ptr,SCAST(32 signed \<rightarrow> 32) 0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. ep_queue_relation' (cslift s) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)}}
 2. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> ?R'd4 badge epptr ep list)
 3. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 4. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 5. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>badge epptr ep list. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) (UNIV \<inter> {s. s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift t) ([] @ list) (head_C (queue_' s)) (StateRelation_C.end_C (queue_' s)) \<and> head_C (queue_' s) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)))))})
 2. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Qa4 bdg (ep_Ptr ptr) ep list \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 3. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> ?Qa4 badge epptr ep x}}}}}))
 4. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> tb \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift tb (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals tb))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift ta) ([] @ list) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x))))))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr ptr) {s'. (s, s') \<in> rf_sr}
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c epptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr)))) \<longrightarrow> s \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptr))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals s))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptr \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptr))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals ta))) \<longrightarrow> tb \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift tb epptr))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals tb))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift ta) ([] @ x) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x))))))}}}}}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>badge epptr ep list s. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; Structures_H.endpoint.SendEP list = ep; (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set list. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ list) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set list. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a)) s\<rbrakk> \<Longrightarrow> {s. s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> tb \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift tb (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals tb))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift ta) ([] @ list) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) = (case list of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x))))))} \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift sa (ep_Ptr ptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift sa (ep_Ptr ptr))))) \<longrightarrow> (s, queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) sa) \<in> rf_sr)}
 2. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c epptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr)))) \<longrightarrow> s \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptr))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals s))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptr \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptr))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals ta))) \<longrightarrow> tb \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift tb epptr))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals tb))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift ta) ([] @ x) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x))))))}}}}}}))
 3. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>badge epptr ep. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP q \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> UNIV}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> {s. \<forall>v. thread_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. s\<lparr>next___ptr_to_struct_tcb_C_' := v\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> (ko_at' ep ptr and invs') s \<longrightarrow> s' \<in> {s. s \<Turnstile>\<^sub>c epptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr)))) \<longrightarrow> s \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s epptr))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals s))) \<longrightarrow> ta \<Turnstile>\<^sub>c epptr \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta epptr))\<lparr>epQueue_head_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals ta))) \<longrightarrow> tb \<Turnstile>\<^sub>c epptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift tb epptr))\<lparr>epQueue_tail_CL := SCAST(32 signed \<rightarrow> 32) 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update epptr endpoint) (t_hrs_' (globals tb))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>)) \<longrightarrow> ep_queue_relation' (cslift ta) ([] @ x) (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s epptr))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s epptr)))) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x))))))}}}}}}))
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>s x sa. \<lbrakk>ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send; (sa, s) \<in> rf_sr; ko_at' (Structures_H.endpoint.SendEP x) ptr sa; invs' sa\<rbrakk> \<Longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> ep_queue_relation' (cslift t) x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)))))
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>s x sa y'. \<lbrakk>ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send; ko_at' (Structures_H.endpoint.SendEP x) ptr sa; invs' sa; map_to_eps (ksPSpace sa) ptr = Some (Structures_H.endpoint.SendEP x); cendpoint_relation (cslift s) (Structures_H.endpoint.SendEP x) y'; cslift s (ep_Ptr ptr) = Some y'\<rbrakk> \<Longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<longrightarrow> s \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift s (ep_Ptr ptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr ptr)))\<lparr>epQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ptr \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ptr)))\<lparr>epQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> ep_queue_relation' (cslift t) x (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr ptr)))))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (ep_Ptr ptr))))) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)))))
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>s x sa y' t ta endpoint tb endpointa tc endpointb. \<lbrakk>ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send; ko_at' (Structures_H.endpoint.SendEP x) ptr sa; invs' sa; map_to_eps (ksPSpace sa) ptr = Some (Structures_H.endpoint.SendEP x); cendpoint_relation (cslift s) (Structures_H.endpoint.SendEP x) y'; cslift s (ep_Ptr ptr) = Some y'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift y')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift y')); endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift s) x (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))) \<and> tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>s x sa y' t ta endpoint tb endpointa tc endpointb. \<lbrakk>ret__unsigned_' s = SCAST(32 signed \<rightarrow> 32) EPState_Send; ko_at' (Structures_H.endpoint.SendEP x) ptr sa; invs' sa; map_to_eps (ksPSpace sa) ptr = Some (Structures_H.endpoint.SendEP x); cslift s (ep_Ptr ptr) = Some y'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift y')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift y')); endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s)); endpoint_lift endpointa = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s))); endpoint_lift endpointb = endpoint_lift y'\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint) (t_hrs_' (globals s)))); endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Send; ep_queue_relation' (cslift s) x (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y')))\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift y')) = (case x of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x)
 2. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ret__unsigned_' s_ = SCAST(32 signed \<rightarrow> 32) EPState_Send; ko_at' (Structures_H.endpoint.SendEP x_) ptr sa_; invs' sa_; map_to_eps (ksPSpace sa_) ptr = Some (Structures_H.endpoint.SendEP x_); cslift s_ (ep_Ptr ptr) = Some y'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift y'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift y'_)); endpoint_lift endpoint_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals s_)); endpoint_lift endpointa_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals s_))); endpoint_lift endpointb_ = endpoint_lift y'_\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2, epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ptr) endpointb_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpointa_) (hrs_mem_update (heap_update (ep_Ptr ptr) endpoint_) (t_hrs_' (globals s_)))); endpoint_CL.state_CL (endpoint_lift y'_) = SCAST(32 signed \<rightarrow> 32) EPState_Send; ep_queue_relation' (cslift s_) x_ (tcb_Ptr (epQueue_head_CL (endpoint_lift y'_))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y'_)))\<rbrakk> \<Longrightarrow> tcb_Ptr (epQueue_head_CL (endpoint_lift y'_)) = (case x_ of [] \<Rightarrow> NULL | x # xs \<Rightarrow> tcb_ptr_to_ctcb_ptr x) proof (prove)
goal (1 subgoal):
 1. \<And>badge epptr s s'. \<lbrakk>badge = bdg; epptr = ep_Ptr ptr; (s, s') \<in> rf_sr; (invs' and ep_at' ptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' ptr and (\<lambda>s. \<forall>ep. ko_at' ep ptr s \<longrightarrow> ((\<lambda>a. (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> True) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> True) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (ko_at' ep ptr and invs' and (ko_at' ep ptr and (\<lambda>a. (\<forall>x\<in>set [] \<union> set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x a) \<and> distinct ([] @ x) \<and> Structures_H.endpoint.IdleEP = Structures_H.endpoint.IdleEP \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> ((state_refs_of' a)(ptr := ep_q_refs_of' Structures_H.endpoint.IdleEP)) p \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues a \<and> pspace_aligned' a \<and> pspace_distinct' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ep' Structures_H.endpoint.IdleEP) a))) a)) and ko_at' ep ptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' epptr)) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> distinct x \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x ko. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; projectKO_opt ko = Some (Structures_H.endpoint.SendEP x)\<rbrakk> \<Longrightarrow> injectKOS (Structures_H.endpoint.SendEP x) = ko
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; valid_obj' (injectKOS (Structures_H.endpoint.SendEP x)) s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> distinct x \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; valid_obj' (injectKOS (Structures_H.endpoint.SendEP x)) s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> distinct x \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' Structures_H.endpoint.IdleEP s proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = refs_of' (injectKOS (Structures_H.endpoint.SendEP x)) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS (Structures_H.endpoint.SendEP x)). ko_wp_at' (\<lambda>ko. (ptr, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> (\<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s) \<and> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ep_at' ptr s_; ko_at' (Structures_H.endpoint.SendEP x_) ptr s_; x_ \<noteq> []; \<forall>t\<in>set x_. tcb_at' t s_; distinct x_; state_refs_of' s_ ptr = set x_ \<times> {EPSend}; \<forall>x\<in>set x_. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s_\<rbrakk> \<Longrightarrow> \<forall>x\<in>set x_. st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = ptr) x s_ proof (prove)
goal (1 subgoal):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> (\<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound) \<and> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> \<forall>p. \<forall>x\<in>set x. \<forall>rf. (x, rf) \<in> (if p = ptr then {} else state_refs_of' s p) \<longrightarrow> rf = NTFNBound
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x p xa rf. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s; p \<noteq> ptr; xa \<in> set x; (xa, rf) \<in> state_refs_of' s p\<rbrakk> \<Longrightarrow> rf = NTFNBound
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x p xa rf. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s; p \<noteq> ptr; xa \<in> set x; (p, symreftype rf) \<in> state_refs_of' s xa\<rbrakk> \<Longrightarrow> rf = NTFNBound
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s proof (prove)
goal (2 subgoals):
 1. \<And>s s' x p xa rf. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; p \<noteq> ptr; xa \<in> set x; (p, symreftype rf) \<in> state_refs_of' s xa; tcb_at' xa s; st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) xa s\<rbrakk> \<Longrightarrow> rf = NTFNBound
 2. \<And>s s' x. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ep_at' ptr s; ko_at' (Structures_H.endpoint.SendEP x) ptr s; x \<noteq> []; \<forall>t\<in>set x. tcb_at' t s; distinct x; state_refs_of' s ptr = set x \<times> {EPSend}; \<forall>x\<in>set x. st_tcb_at' (\<lambda>ts. \<exists>a b c d. ts = Structures_H.thread_state.BlockedOnSend ptr a b c d) x s\<rbrakk> \<Longrightarrow> Invariants_H.valid_queues s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s