theory Ipc_C

lemma sendIPC_ccorres [corres]:
  "ccorres dc xfdc (invs' and st_tcb_at' simple' thread
                          and sch_act_not thread and ep_at' epptr and
                          (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))))
     (UNIV \<inter> \<lbrace>\<acute>blocking = from_bool blocking\<rbrace>
           \<inter> \<lbrace>\<acute>do_call = from_bool do_call\<rbrace>
           \<inter> \<lbrace>\<acute>badge = badge\<rbrace>
           \<inter> \<lbrace>\<acute>canGrant = from_bool canGrant\<rbrace>
           \<inter> \<lbrace>\<acute>canGrantReply = from_bool canGrantReply\<rbrace>
           \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
           \<inter> \<lbrace>\<acute>epptr = Ptr epptr\<rbrace>
           \<inter> \<lbrace>badge && mask 28 = badge\<rbrace>) hs
     (sendIPC blocking do_call badge canGrant canGrantReply thread epptr)
     (Call sendIPC_'proc)" unfolding K_def apply (rule ccorres_gen_asm2) apply (cinit' lift: blocking_' do_call_' badge_' canGrant_' canGrantReply_' thread_' epptr_') apply (unfold sendIPC_def)[1] apply (rule ccorres_pre_getEndpoint) apply (rename_tac ep) apply (rule_tac xf'=ret__unsigned_'
               and val="case ep of IdleEP \<Rightarrow> scast EPState_Idle
                           | RecvEP _ \<Rightarrow> scast EPState_Recv
                           | SendEP _ \<Rightarrow> scast EPState_Send"
               and R="ko_at' ep epptr"
                in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply (vcg, clarsimp) apply (erule cmap_relationE1 [OF cmap_relation_ep]) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps cendpoint_relation_def Let_def
                     split: endpoint.split_asm) apply ceqv apply (rule_tac A="invs' and st_tcb_at' simple' thread
                          and sch_act_not thread and ko_at' ep epptr
                          and ep_at' epptr
                          and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))"
                 in ccorres_guard_imp2 [where A'=UNIV]) apply wpc
       \<comment> \<open>RecvEP case\<close> apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (intro ccorres_rhs_assoc) apply (csymbr, csymbr) apply wpc apply (simp only: haskell_fail_def) apply (rule ccorres_fail) apply (rename_tac dest rest) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac dest=dest in sendIPC_dequeue_ccorres_helper) apply simp apply ceqv apply (rename_tac dest') apply (simp only: K_bind_def haskell_assert_def return_bind from_bool_0) apply (rule getThreadState_ccorres_foo) apply (rename_tac recvState) apply (rule ccorres_assert) apply (ctac(no_vcg)) apply (rule ccorres_rhs_assoc2) apply (rule_tac xf'=replyCanGrant_' and val="from_bool (blockingIPCCanGrant recvState)"
                   and R="st_tcb_at' ((=) recvState) dest" and R'=UNIV
                   in ccorres_symb_exec_r_known_rv) apply (clarsimp, rule conseqPre, vcg) apply (fastforce simp: pred_tcb_at'_def tcb_at_h_t_valid typ_heap_simps'
                              dest: obj_at_cslift_tcb ctcb_relation_blockingIPCCanGrantD) apply ceqv apply (ctac(no_vcg)) apply (ctac(no_vcg) add: possibleSwitchTo_ccorres) apply (clarsimp split del: if_split) apply (wpc ; ccorres_rewrite) apply (clarsimp simp: disj_imp[symmetric] split del: if_split) apply (wpc ; clarsimp) apply ccorres_rewrite apply (ctac add: setupCallerCap_ccorres) apply ccorres_rewrite apply (ctac add: setThreadState_ccorres) apply (rule ccorres_return_Skip) apply (wpsimp wp: hoare_drop_imps hoare_vcg_all_lift possibleSwitchTo_sch_act_not
                              possibleSwitchTo_sch_act_not sts_st_tcb'
                              possibleSwitchTo_ksQ' sts_valid_queues sts_ksQ'
                          simp: valid_tcb_state'_def)+ apply vcg apply (wpsimp wp: doIPCTransfer_sch_act setEndpoint_ksQ hoare_vcg_all_lift
                          set_ep_valid_objs' setEndpoint_valid_mdb'
                | wp (once) hoare_drop_imp
                | strengthen sch_act_wf_weak)+ apply (fastforce simp: guard_is_UNIV_def ThreadState_Inactive_def Collect_const_mem
                               ThreadState_Running_def mask_def from_bool_def
                               option_to_ptr_def option_to_0_def
                        split: bool.split_asm)

      \<comment> \<open>IdleEP case\<close> apply (rule ccorres_cond_true) apply (rule ccorres_cond) apply (clarsimp simp: from_bool_def split: bool.split)
       \<comment> \<open>blocking case\<close> apply (intro ccorres_rhs_assoc) apply csymbr apply (simp only:)
       \<comment> \<open>apply (ctac (trace, no_vcg,c_lines 6) add: sendIPC_block_ccorres_helper)\<close> apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_split_nothrow_novcg) apply (rule sendIPC_block_ccorres_helper) apply ceqv apply (simp only: K_bind_def fun_app_def) apply (rule_tac ep=IdleEP in sendIPC_enqueue_ccorres_helper) apply (simp add: valid_ep'_def) apply (wp sts_st_tcb') apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply (clarsimp simp: guard_is_UNIV_def) apply (rule ccorres_return_Skip)
     \<comment> \<open>SendEP case\<close> apply (rule ccorres_cond_true) apply (rule ccorres_cond) apply (clarsimp simp: from_bool_def split: bool.split)
      \<comment> \<open>blocking case\<close> apply (intro ccorres_rhs_assoc) apply csymbr
      \<comment> \<open>apply (ctac (no_vcg,c_lines 6) add: sendIPC_block_ccorres_helper)\<close> apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rule ccorres_rhs_assoc2) apply (rename_tac list) apply (rule ccorres_split_nothrow_novcg) apply (simp only: ) apply (rule sendIPC_block_ccorres_helper) apply ceqv apply (simp only: K_bind_def fun_app_def) apply (rule_tac ep="SendEP list" in sendIPC_enqueue_ccorres_helper) apply (simp add: valid_ep'_def) apply (wp sts_st_tcb') apply (clarsimp simp: obj_at'_def ko_wp_at'_def projectKOs) apply (clarsimp simp: guard_is_UNIV_def) apply (rule ccorres_return_Skip) apply (clarsimp simp: EPState_Recv_def EPState_Send_def EPState_Idle_def
                   split: if_split) apply (frule(1) ko_at_valid_objs'[OF _ invs_valid_objs']) apply (clarsimp simp: projectKO_opt_ep split: kernel_object.split_asm) apply (subgoal_tac "epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x =
                          state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin>
                            ep_q_refs_of' ep)") apply (clarsimp simp: valid_obj'_def valid_ep'_def refs_of'_def
                    split: endpoint.splits) apply (frule(1) sym_refs_obj_atD'[OF _ invs_sym']) apply (clarsimp simp: st_tcb_at_refs_of_rev' isBlockedOnReceive_def) apply (auto split: list.splits elim!: pred_tcb'_weakenE)[1] apply (subgoal_tac "state_refs_of' s epptr = {}") apply (clarsimp simp: obj_at'_def is_aligned_neg_mask objBits_simps'
                             projectKOs invs'_def valid_state'_def
                             st_tcb_at'_def valid_tcb_state'_def ko_wp_at'_def
                             isBlockedOnSend_def projectKO_opt_tcb
                      split: if_split_asm if_split) apply (rule conjI, simp, rule impI, clarsimp simp: valid_pspace_valid_objs') apply (erule delta_sym_refs) apply (clarsimp split: if_split_asm
                        dest!: symreftype_inverse')+ apply (clarsimp simp: pred_tcb_at'_def obj_at'_def tcb_bound_refs'_def
                              projectKOs eq_sym_conv
                       dest!: symreftype_inverse'
                       split: if_split_asm) apply (clarsimp simp: pred_tcb_at'_def obj_at'_def projectKOs
                             tcb_bound_refs'_def eq_sym_conv) apply (clarsimp simp: obj_at'_def state_refs_of'_def projectKOs) apply (frule(1) sym_refs_obj_atD'[OF _ invs_sym']) apply clarsimp apply (rule conjI, assumption) apply (clarsimp dest!: st_tcb_strg'[rule_format]
                      simp: invs'_def valid_state'_def obj_at'_def objBits_simps
                            projectKOs valid_tcb_state'_def) apply (rule conjI[rotated]) apply (clarsimp simp: isBlockedOnSend_def ko_wp_at'_def obj_at'_def
                            projectKOs projectKO_opt_tcb objBits_simps') apply (fastforce split: if_split_asm
                        elim: delta_sym_refs
                        simp: pred_tcb_at'_def obj_at'_def projectKOs
                              tcb_bound_refs'_def eq_sym_conv symreftype_def) apply clarsimp apply (frule(1) sym_refs_obj_atD'[OF _ invs_sym']) apply (frule simple_st_tcb_at_state_refs_ofD') apply (case_tac ep, auto simp: st_tcb_at_refs_of_rev' st_tcb_at'_def
                                   obj_at'_def projectKOs)[1] apply (clarsimp simp: guard_is_UNIV_def) apply (clarsimp simp: guard_is_UNIV_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) (UNIV \<inter> \<lbrace>\<acute>blocking = from_bool blocking\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool do_call\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool canGrant\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool canGrantReply\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr epptr\<rbrace> \<inter> \<lbrace>badge && mask 28 = badge\<rbrace>) hs (sendIPC blocking do_call badge canGrant canGrantReply thread epptr) (Call sendIPC_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) (UNIV \<inter> \<lbrace>\<acute>blocking = from_bool blocking\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool do_call\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool canGrant\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool canGrantReply\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr epptr\<rbrace> \<inter> \<lbrace>badge && mask 28 = badge\<rbrace>) hs (sendIPC blocking do_call badge canGrant canGrantReply thread epptr) (Call sendIPC_'proc) proof (prove)
goal (1 subgoal):
 1. badge && mask 28 = badge \<Longrightarrow> ccorres dc xfdc (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) (UNIV \<inter> \<lbrace>\<acute>blocking = from_bool blocking\<rbrace> \<inter> \<lbrace>\<acute>do_call = from_bool do_call\<rbrace> \<inter> \<lbrace>\<acute>badge = badge\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool canGrant\<rbrace> \<inter> \<lbrace>\<acute>canGrantReply = from_bool canGrantReply\<rbrace> \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>epptr = ep_Ptr epptr\<rbrace>) hs (sendIPC blocking do_call badge canGrant canGrantReply thread epptr) (Call sendIPC_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga) (?Q'6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga) (SKIP # hs) (sendIPC blocking do_call badge canGrant canGrantReply thread epptr) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga s \<and> s' \<in> ?Q'6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga proof (prove)
goal (2 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga) (?Q'6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga) (SKIP # hs) (do ep <- getEndpoint epptr;
case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()
od) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga s \<and> s' \<in> ?Q'6102 epptra threada canGrantReplya canGranta badgea do_calla blockinga proof (prove)
goal (2 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?P'6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> ?P6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> ?P'6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} proof (prove)
goal (2 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?P'6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> ?P6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> ?P'6110 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ep epptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL endpoint_ptr_get_state_'proc(epptra) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)\<rbrace>)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s x. \<lbrakk>badge && mask 28 = badge; ko_at' ep epptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ep s x. \<lbrakk>badge && mask 28 = badge; ko_at' ep epptr s\<rbrakk> \<Longrightarrow> map_to_eps (ksPSpace s) (?x6142 ep s x) = Some (?y6142 ep s x)
 2. \<And>ep s x y'. \<lbrakk>badge && mask 28 = badge; ko_at' ep epptr s; map_to_eps (ksPSpace s) (?x6142 ep s x) = Some (?y6142 ep s x); cendpoint_relation (cslift x) (?y6142 ep s x) y'; cslift x (ep_Ptr (?x6142 ep s x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ep s x y'. \<lbrakk>badge && mask 28 = badge; ko_at' ep epptr s; map_to_eps (ksPSpace s) epptr = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> endpoint_CL.state_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (?y'6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. ?Q6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (?P6112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6819 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q'6819 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (case ep of Structures_H.endpoint.RecvEP [] \<Rightarrow> haskell_fail [] | Structures_H.endpoint.RecvEP (dest # queue) \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od | Structures_H.endpoint.IdleEP \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return () | Structures_H.endpoint.SendEP queue \<Rightarrow> if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ queue @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q6819 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s \<and> s' \<in> ?Q'6819 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?R''6834 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R''6834 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?R'6839 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R'6839 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?R'6841 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R'6841 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?R'6841 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (lvar_nondet_init queue_' queue_'_update;;
(lvar_nondet_init dest_' dest_'_update;;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> ?R'6841 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?G'6867 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (case x1 of [] \<Rightarrow> haskell_fail [] | dest # queue \<Rightarrow> do setEndpoint epptr $ case queue of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP queue;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> ?R6831 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> ?G'6867 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6885 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (?R''6887 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1) (SKIP # hs) (haskell_fail []) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (SKIP # hs) (do setEndpoint epptr $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP x22;
recvState <- getThreadState x21;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant x21;
setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread x21 (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> ?R6885 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''6887 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP []; x1 = []\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6885 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP []) []) (?R''6887 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP []) []) (SKIP # hs) fail (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr thread,ep_Ptr epptr,badge,from_bool canGrant,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF from_bool do_call \<noteq> 0 THEN
  IF from_bool canGrant = 0 \<longrightarrow> from_bool canGrantReply \<noteq> 0 THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (SKIP # hs) (do setEndpoint epptr $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP x22;
recvState <- getThreadState x21;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant x21;
setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread x21 (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> ?R6885 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> ?R''6887 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = x21 # x22\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 x21 x22) (SKIP # hs) (do setEndpoint epptr $ case x22 of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP x22;
recvState <- getThreadState x21;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant x21;
setThreadState Structures_H.thread_state.Running x21;
possibleSwitchTo x21;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread x21 (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (SKIP # hs) (do setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (SKIP # hs) (do setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
(\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (SKIP # hs) (do setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
(CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (SKIP # hs) (do setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
(IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (SKIP # hs) (do setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest;
recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
(CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> ?R6886 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ccorres (?r'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?xf'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?P6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) [] (setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) rv' t t' (CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest; ?r'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv') (SKIP # hs) (K_bind (do recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) rv) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?xf'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (?P6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> ?R''6888 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> epptra = ep_Ptr epptr
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dest_' rv' t t' (CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv') (SKIP # hs) (K_bind (do recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) rv) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dest_' rv' t t' (CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv') (SKIP # hs) (K_bind (do recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) rv) (?d'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest; rv' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv rv') (SKIP # hs) (K_bind (do recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) rv) (CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,rv');;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c rv'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(rv'\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(rv',SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(rv');;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,rv',\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv) (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest') (SKIP # hs) (K_bind (do recvState <- getThreadState dest;
haskell_assert (isReceive recvState) [];
doIPCTransfer thread (Just epptr) badge canGrant dest;
setThreadState Structures_H.thread_state.Running dest;
possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) rv) (CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,dest');;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c dest'} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(dest'\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(dest',SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(dest');;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,dest',\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6899 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv) (?Q'6899 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest)) (SKIP # hs) (do recvState <- getThreadState dest;
y <- assert (isReceive recvState);
y <- doIPCTransfer thread (Just epptr) badge canGrant dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr thread,ep_Ptr epptr,badge,from_bool canGrant,tcb_ptr_to_ctcb_ptr dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>?Q6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (?Q'6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' rva. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P7112 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv a rva) (?P'7113 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) rva) (SKIP # hs) (do y <- assert (isReceive rva);
y <- doIPCTransfer thread (Just epptr) badge canGrant dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant rva) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr thread,ep_Ptr epptr,badge,from_bool canGrant,tcb_ptr_to_ctcb_ptr dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> ?P7112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a aa ts\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'7113 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>a. ?P7112 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv a recvState) (?P'7113 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) recvState) (SKIP # hs) (do y <- assert (isReceive recvState);
y <- doIPCTransfer thread (Just epptr) badge canGrant dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr thread,ep_Ptr epptr,badge,from_bool canGrant,tcb_ptr_to_ctcb_ptr dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> ?P7112 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a aa ts\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'7113 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P7119 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState) (?P'7113 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) recvState) (SKIP # hs) (do y <- doIPCTransfer thread (Just epptr) badge canGrant dest;
y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (x, xa) \<Rightarrow> case x of True \<Rightarrow> case xa of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()
od) (CALL doIPCTransfer_'proc(tcb_ptr_to_ctcb_ptr thread,ep_Ptr epptr,badge,from_bool canGrant,tcb_ptr_to_ctcb_ptr dest);;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> ?P7119 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts aa\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> ?P'7113 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q7126 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q'7140 dest rest rv recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
(\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>?Q7126 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'7139 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?Q'7140 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?Q'7139 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q7126 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q'7140 dest rest rv recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>?Q7126 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'7139 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?Q'7140 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?Q'7139 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc s. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. st_tcb_at' ((=) recvState) dest s \<and> (s, s') \<in> rf_sr}) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>replyCanGrant = from_bool (blockingIPCCanGrant recvState)\<rbrace>)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> replyCanGrant_' rv' t t' (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca (from_bool (blockingIPCCanGrant recvState)))
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc\<^esub> (?P'7186 dest rest rv recvState rva xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> ?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc}
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. ?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
A total of 12 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>dest recvState s. \<lbrakk>badge && mask 28 = badge; isReceive recvState\<rbrakk> \<Longrightarrow> {s'. st_tcb_at' ((=) recvState) dest s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest \<and> sa \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> (s, replyCanGrant_'_update (\<lambda>_. blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))) (sa\<lparr>ret__unsigned_' := blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])) [''tcbState_C''])))))\<rparr>)) \<in> rf_sr \<and> blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift sa (cparent (PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = from_bool (blockingIPCCanGrant recvState))}
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> replyCanGrant_' rv' t t' (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca (from_bool (blockingIPCCanGrant recvState)))
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc\<^esub> (?P'7186 dest rest rv recvState rva xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> ?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc}
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. ?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
A total of 12 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> replyCanGrant_' rv' t t' (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc rv')
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (?y'7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca (from_bool (blockingIPCCanGrant recvState)))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc\<^esub> (?P'7186 dest rest rv recvState rva xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> ?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc}
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. ?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (10 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva) (?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca) (SKIP # hs) (do y <- setThreadState Structures_H.thread_state.Running dest;
y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
(CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc\<^esub> (?P'7186 dest rest rv recvState rva xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> ?Q7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc}
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. ?P7188 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdcb. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q7428 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb) (?Q'7428 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdcb) (SKIP # hs) (do y <- possibleSwitchTo dest;
case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()
od) (CALL possibleSwitchTo_'proc(tcb_ptr_to_ctcb_ptr dest);;
IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>?Q7428 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'7428 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t)}}
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdcb rvc xfdcc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdcb; dc rvc xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdcb rvc) (?Q'7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdcb rvc xfdcc) (SKIP # hs) (case (do_call, canGrant \<or> canGrantReply) of (True, True) \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | (True, False) \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | (False, xa) \<Rightarrow> return ()) (IF \<not> \<not> do_call THEN
  IF \<not> canGrant \<longrightarrow> \<not> \<not> canGrantReply THEN
  CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))
ELSE
  CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>?Q7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
A total of 12 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q7475 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?Q'7475 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (case do_call of True \<Rightarrow> case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread | False \<Rightarrow> return ()) (Cond (if do_call then UNIV else {}) (Cond (if \<not> canGrant \<longrightarrow> canGrantReply then UNIV else {}) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))) SKIP)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>?Q7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'7475 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
A total of 12 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = True\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7544 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7546 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread) (Cond (if \<not> canGrant \<longrightarrow> canGrantReply then UNIV else {}) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ?R7544 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> ?R''7546 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7544 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7546 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (case canGrant \<or> canGrantReply of True \<Rightarrow> setupCallerCap thread dest (blockingIPCCanGrant recvState) | False \<Rightarrow> setThreadState Structures_H.thread_state.Inactive thread) (Cond (if canGrant \<or> canGrantReply then UNIV else {}) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ?R7544 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> ?R''7546 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (14 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; canGrant \<or> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7640 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7642 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setupCallerCap thread dest (blockingIPCCanGrant recvState)) (Cond UNIV (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; \<not> canGrant; \<not> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7639 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7641 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive thread) (Cond {} (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 3. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> ?R7640 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> ?R7639 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> ?R''7642 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> ?R''7641 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (14 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; canGrant \<or> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7640 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7642 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setupCallerCap thread dest (blockingIPCCanGrant recvState)) (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState)))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; \<not> canGrant; \<not> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7639 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7641 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive thread) (Cond {} (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 3. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> ?R7640 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> ?R7639 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> ?R''7642 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> ?R''7641 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; \<not> canGrant; \<not> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7639 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7641 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive thread) (Cond {} (CALL setupCallerCap_'proc(tcb_ptr_to_ctcb_ptr thread,tcb_ptr_to_ctcb_ptr dest,from_bool (blockingIPCCanGrant recvState))) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not thread and tcb_at' thread and tcb_at' dest and tcb_at' thread and tcb_at' dest) b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> ?R7639 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant recvState)) (receiver_'_update (\<lambda>_. dest') (sender_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = dest'\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (blockingIPCCanGrant recvState)\<rbrace>}} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> ?R''7641 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (13 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call; \<not> canGrant; \<not> canGrantReply\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7639 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7641 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (SCAST(32 signed \<rightarrow> 32) false) (SCAST(32 signed \<rightarrow> 32) false) badge (SCAST(32 signed \<rightarrow> 32) true) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (setThreadState Structures_H.thread_state.Inactive thread) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive))
 2. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not thread and tcb_at' thread and tcb_at' dest and tcb_at' thread and tcb_at' dest) b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> ?R7639 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant recvState)) (receiver_'_update (\<lambda>_. dest') (sender_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = dest'\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (blockingIPCCanGrant recvState)\<rbrace>}} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> ?R''7641 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (12 subgoals):
 1. \<And>dest rest recvState xfdca xfdcb xfdcc. \<lbrakk>badge && mask 28 = badge; isReceive recvState; do_call = False\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R7543 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb ()) (?R''7545 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdca () xfdcb () xfdcc) (SKIP # hs) (return ()) SKIP
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not thread and tcb_at' thread and tcb_at' dest and tcb_at' thread and tcb_at' dest) b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (do_call = False \<longrightarrow> ?R7543 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc a b)\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rvb. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>ta rvc. dc rvc (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant recvState)) (receiver_'_update (\<lambda>_. dest') (sender_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = dest'\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (blockingIPCCanGrant recvState)\<rbrace>}} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. threada) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = threada\<rbrace>}}} \<inter> {s. do_call = False \<longrightarrow> s \<in> ?R''7545 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb (xfdc t) rvc (xfdc ta)}}}}
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
A total of 12 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (11 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca rvb\<rbrace> possibleSwitchTo dest \<lbrace>\<lambda>a b. (do_call = True \<longrightarrow> ((canGrant \<or> canGrantReply) = True \<longrightarrow> (Invariants_H.valid_queues and valid_pspace' and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s) and sch_act_not thread and tcb_at' thread and tcb_at' dest and tcb_at' thread and tcb_at' dest) b) \<and> ((canGrant \<or> canGrantReply) = False \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> valid_tcb_state' Structures_H.thread_state.Inactive b \<and> (ksSchedulerAction b = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> (\<forall>p. thread \<in> set (ksReadyQueues b p) \<longrightarrow> runnable' Structures_H.thread_state.Inactive) \<and> sch_act_wf (ksSchedulerAction b) b)) \<and> (do_call = False \<longrightarrow> True)\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva\<rbrace> setThreadState Structures_H.thread_state.Running dest \<lbrace>\<lambda>a. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and st_tcb_at' runnable' dest and (\<lambda>s. ksCurDomain s \<le> maxDomain) and valid_objs' and ?R7479 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdc a\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState; dc rva xfdca\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState rva xfdca\<^esub> (?P'7186 dest rest rv recvState rva xfdca) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. \<forall>rv. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr dest\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. target_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr dest) s \<in> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr dest\<rbrace> \<inter> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. do_call = True \<longrightarrow> s \<in> {s. (canGrant \<or> canGrantReply) = True \<longrightarrow> s \<in> {s. canGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant recvState)) (receiver_'_update (\<lambda>_. dest') (sender_'_update (\<lambda>_. threada) s)) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = dest'\<rbrace> \<inter> \<lbrace>\<acute>canGrant = from_bool (blockingIPCCanGrant recvState)\<rbrace>}} \<inter> {s. (canGrant \<or> canGrantReply) = False \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive) (tptr_'_update (\<lambda>_. threada) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Inactive (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = threada\<rbrace>}}} \<inter> {s. do_call = False \<longrightarrow> s \<in> UNIV}}}}
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R7432 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState a and st_tcb_at' ((=) recvState) dest\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (9 subgoals):
 1. \<And>dest rest recvState xfdc. \<lbrakk>badge && mask 28 = badge; isReceive recvState\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?Ft7181 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest () (tcb_ptr_to_ctcb_ptr dest) recvState () xfdc\<^esub> (?P'7186 dest rest () recvState () xfdc) Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr dest} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned {s. replyCanGrant_' s = from_bool (blockingIPCCanGrant recvState) \<longrightarrow> s \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running then UNIV else {}) \<and> (do_call \<longrightarrow> \<not> canGrant \<and> \<not> canGrantReply \<longrightarrow> (\<forall>t. s\<lparr>globals := globals t\<rparr> \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive then UNIV else {})))}
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (valid_pspace' and tcb_at' dest and valid_tcb_state' Structures_H.thread_state.Running) a \<and> (\<forall>x xa. ((runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> thread \<notin> set (ksReadyQueues a (x, xa))) \<and> sch_act_not thread a \<and> K (thread \<noteq> dest) a) \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> sch_act_not thread a \<and> K (dest \<noteq> thread) a \<and> tcb_at' thread a \<and> tcb_at' dest a \<and> tcb_at' thread a \<and> tcb_at' dest a \<and> tcb_at' thread a \<and> (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> sch_act_not thread a \<and> K (dest \<noteq> thread) a \<and> (\<forall>x xa. ((runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> thread \<notin> set (ksReadyQueues a (x, xa))) \<and> sch_act_not thread a \<and> K (thread \<noteq> dest) a) \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> True) and st_tcb_at' ((=) recvState) dest\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?P'7185 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a b ts t rv \<inter> UNIV}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV}
flex-flex pairs:
\<lambda>dest rest rv recvState t rva. ?P'7186 dest rest rv recvState rva (xfdc t) \<equiv>\<^sup>? \<lambda>dest rest rv. ?P'7185 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv (tcb_ptr_to_ctcb_ptr dest) proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest rv dest' recvState. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP (dest # rest); x1 = dest # rest; dest' = tcb_ptr_to_ctcb_ptr dest; isReceive recvState\<rbrakk> \<Longrightarrow> \<lbrace>?R7134 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.RecvEP (dest # rest)) (dest # rest) dest rest rv recvState\<rbrace> doIPCTransfer thread (Just epptr) badge canGrant dest \<lbrace>\<lambda>a. (\<lambda>a. tcb_at' dest a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. dest \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (weak_sch_act_wf (ksSchedulerAction a) a \<and> (ksSchedulerAction a = SwitchToThread dest \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> ksCurDomain a \<le> maxDomain \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (valid_pspace' and tcb_at' dest and valid_tcb_state' Structures_H.thread_state.Running) a \<and> (\<forall>x xa. ((runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> thread \<notin> set (ksReadyQueues a (x, xa))) \<and> sch_act_not thread a \<and> K (thread \<noteq> dest) a) \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> sch_act_not thread a \<and> K (dest \<noteq> thread) a \<and> tcb_at' thread a \<and> tcb_at' dest a \<and> tcb_at' thread a \<and> tcb_at' dest a \<and> tcb_at' thread a \<and> (Invariants_H.valid_queues a \<and> ((\<exists>p. dest \<in> set (ksReadyQueues a p)) \<longrightarrow> runnable' Structures_H.thread_state.Running)) \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (valid_tcb_state' Structures_H.thread_state.Running and valid_objs') a \<and> sch_act_not thread a \<and> K (dest \<noteq> thread) a \<and> (\<forall>x xa. ((runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> thread \<notin> set (ksReadyQueues a (x, xa))) \<and> sch_act_not thread a \<and> K (thread \<noteq> dest) a) \<and> ((\<not> runnable' Structures_H.thread_state.Running \<longrightarrow> sch_act_simple a) \<and> sch_act_wf (ksSchedulerAction a) a) \<and> (if dest = dest then K (runnable' Structures_H.thread_state.Running) else st_tcb_at' runnable' dest) a \<and> (runnable' Structures_H.thread_state.Running \<or> ksCurThread a \<noteq> dest) \<and> True) and st_tcb_at' ((=) recvState) dest\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> \<lbrace>?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest\<rbrace> setEndpoint epptr $ case rest of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP rest \<lbrace>\<lambda>a aa. \<forall>ts. st_tcb_at' ((=) ts) dest aa \<longrightarrow> (valid_pspace' and cur_tcb' and tcb_at' thread and tcb_at' dest and K (dest \<noteq> thread \<and> Just epptr \<noteq> Some 0) and ?R7134 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest a ts) aa\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x1 dest rest. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.RecvEP x1; x1 = dest # rest\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb') \<longrightarrow> s \<in> {s. receiver_'_update (\<lambda>_. b) (grant_'_update (\<lambda>_. canGranta) (badge_'_update (\<lambda>_. badgea) (endpoint_'_update (\<lambda>_. epptra) (sender_'_update (\<lambda>_. threada) s)))) \<in> UNIV \<inter> \<lbrace>\<acute>sender = threada\<rbrace> \<inter> \<lbrace>\<acute>receiver = b\<rbrace> \<inter> \<lbrace>canGrant = to_bool \<acute>grant\<rbrace> \<inter> \<lbrace>\<acute>badge = badgea\<rbrace> \<inter> \<lbrace>\<acute>endpoint = option_to_ptr (Just epptr)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<Turnstile>\<^sub>c b \<longrightarrow> s \<Turnstile>\<^sub>c cparent (PTR(thread_state_C) &(b\<rightarrow>[''tcbState_C''])) [''tcbState_C''] \<and> (\<forall>t. ret__unsigned_' t = blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(b\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) \<longrightarrow> blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift s (cparent (PTR(thread_state_C) &(b\<rightarrow>[''tcbState_C''])) [''tcbState_C'']))))) = from_bool (blockingIPCCanGrant ts) \<longrightarrow> replyCanGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant ts)) (s\<lparr>ret__unsigned_' := from_bool (blockingIPCCanGrant ts)\<rparr>) \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running then UNIV else {}) \<and> (do_call \<longrightarrow> \<not> canGrant \<and> \<not> canGrantReply \<longrightarrow> (\<forall>t. s\<lparr>ret__unsigned_' := from_bool (blockingIPCCanGrant ts), replyCanGrant_' := from_bool (blockingIPCCanGrant ts), globals := globals t\<rparr> \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive then UNIV else {}))))} \<inter> UNIV}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and ?R6899 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x xa xb) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>dest. badge && mask 28 = badge \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = tcb_ptr_to_ctcb_ptr dest) dest_' (\<lambda>a b. {s. \<forall>ts. (\<exists>tcb'. cslift s b = Some tcb' \<and> cthread_state_relation ts (tcbState_C tcb', tcbFault_C tcb')) \<longrightarrow> s \<in> (if ep_Ptr epptr = option_to_ptr (Some epptr) then UNIV else {}) \<and> (\<forall>t. t \<Turnstile>\<^sub>c b \<longrightarrow> (\<exists>ta. ret__unsigned_' ta = blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift t b))))) \<longrightarrow> blockingIPCCanGrant_CL (thread_state_lift (tcbState_C (the (cslift t b)))) = from_bool (blockingIPCCanGrant ts) \<longrightarrow> replyCanGrant_'_update (\<lambda>_. from_bool (blockingIPCCanGrant ts)) (s\<lparr>globals := globals t, ret__unsigned_' := from_bool (blockingIPCCanGrant ts)\<rparr>) \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running then UNIV else {}) \<and> (do_call \<longrightarrow> \<not> canGrant \<and> \<not> canGrantReply \<longrightarrow> (\<forall>t. s\<lparr>ret__unsigned_' := from_bool (blockingIPCCanGrant ts), replyCanGrant_' := from_bool (blockingIPCCanGrant ts), globals := globals t\<rparr> \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive then UNIV else {}))))})
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R''6835 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?R'8604 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od else return ()) (IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R6832 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ?R'8604 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> ?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s \<longrightarrow> blocking = (s' \<in> \<lbrace>blockinga \<noteq> 0\<rbrace>)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> (?Rt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
(CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> ?Pt8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres (?r'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?xf'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?P8665 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) (?G'8626 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP) [] (setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) rv' t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))) (?d'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP; ?r'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv) (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]) rv) (?d'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?xf'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (?P8665 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8626 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue)))) (?d'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv) (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]) rv) (?d'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv) (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP [thread]) rv) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8659 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP rv) (?Q'8659 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP rv rv') (SKIP # hs) (setEndpoint epptr (Structures_H.endpoint.SendEP [thread])) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8659 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set [thread] \<times> {EPSend}))) and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = epptr) thread and ko_at' ep epptr and K (ep = ep \<and> [thread] = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.SendEP q \<and> thread \<notin> set q \<and> [thread] = q @ [thread]))\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> \<lbrace>?R8663 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = epptr) thread b \<and> ko_at' Structures_H.endpoint.IdleEP epptr b\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8663 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. badge && mask 28 = badge \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>a b. UNIV)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep) (SKIP # hs) (return ()) SKIP
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle THEN
  IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI
ELSE
  IF (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv THEN
  lvar_nondet_init queue_' queue_'_update;;
lvar_nondet_init dest_' dest_'_update;;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>dest :== head_C \<acute>queue;;
\<acute>queue :== CALL tcbEPDequeue_'proc(\<acute>dest,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI;;
CALL doIPCTransfer_'proc(threada,epptra,badgea,canGranta,\<acute>dest);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c dest_' s} (\<acute>ret__unsigned :== CALL thread_state_ptr_get_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(\<acute>dest\<rightarrow>[''tcbState_C''])));;
\<acute>replyCanGrant :== \<acute>ret__unsigned;;
CALL setThreadState_'proc(\<acute>dest,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
CALL possibleSwitchTo_'proc(\<acute>dest);;
IF do_calla \<noteq> 0 THEN
  IF canGranta = 0 \<longrightarrow> canGrantReplya \<noteq> 0 THEN
  CALL setupCallerCap_'proc(threada,\<acute>dest,\<acute>replyCanGrant)
ELSE
  CALL setThreadState_'proc(threada,SCAST(32 signed \<rightarrow> 32) ThreadState_Inactive)
FI
FI
FI
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R''6836 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x}})
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?R'8724 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (if blocking then do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od else return ()) (IF blockinga \<noteq> 0 THEN
  lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)
FI)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R6833 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ?R'8724 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> ?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3 s \<longrightarrow> blocking = (s' \<in> \<lbrace>blockinga \<noteq> 0\<rbrace>)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (lvar_nondet_init queue_' queue_'_update;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> (?Rt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
(CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ x3 @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (SKIP # hs) (do setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread;
setEndpoint epptr $ Structures_H.endpoint.SendEP $ list @ [thread]
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada);;
(\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> ?Pt8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres (?r'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?xf'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?P8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) [] (setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val epptra)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badgea));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGranta));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) canGrantReplya));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c threada} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(threada\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) do_calla));;
CALL scheduleTCB_'proc(threada))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) rv' t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list; ?r'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP $ list @ [thread]) rv) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?xf'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (?P8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ccorres (?r'8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list) (?xf'8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list) (?P8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list) (?G'8746 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list) [] (setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread) (Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_tsType_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),SCAST(32 signed \<rightarrow> 32) ThreadState_BlockedOnSend));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingObject_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (ptr_val (ep_Ptr epptr))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCBadge_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) badge));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrant_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrant)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCCanGrantReply_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool canGrantReply)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread} (CALL thread_state_ptr_set_blockingIPCIsCall_'proc(PTR(thread_state_C) &(tcb_ptr_to_ctcb_ptr thread\<rightarrow>[''tcbState_C'']),UCAST(32 \<rightarrow> 32) (from_bool do_call)));;
CALL scheduleTCB_'proc(tcb_ptr_to_ctcb_ptr thread))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) rv' t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list; ?r'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP $ list @ [thread]) rv) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace>
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?xf'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (?P8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> ?G'8746 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv' t t'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue)))) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP $ list @ [thread]) rv) (?d'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv')
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace>
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv) (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv') (SKIP # hs) (K_bind (setEndpoint epptr $ Structures_H.endpoint.SendEP $ list @ [thread]) rv) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(epptra);;
(\<acute>queue :== CALL tcbEPAppend_'proc(threada,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(epptra,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(epptra,\<acute>queue))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list rv rv'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list rv) (?Q'8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list rv rv') (SKIP # hs) (setEndpoint epptr (Structures_H.endpoint.SendEP (list @ [thread]))) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(ep_Ptr epptr);;
(\<acute>queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
(CALL endpoint_ptr_set_state_'proc(ep_Ptr epptr,SCAST(32 signed \<rightarrow> 32) EPState_Send);;
CALL ep_ptr_set_queue_'proc(ep_Ptr epptr,\<acute>queue))))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>?Q8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace>
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>\<lambda>a. valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(epptr := set (list @ [thread]) \<times> {EPSend}))) and st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = epptr) thread and ko_at' ep epptr and K (ep = Structures_H.endpoint.IdleEP \<and> list @ [thread] = [thread] \<or> (\<exists>q. ep = Structures_H.endpoint.SendEP q \<and> thread \<notin> set q \<and> list @ [thread] = q @ [thread]))\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> \<lbrace>?R8767 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP list) list\<rbrace> setThreadState (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) thread \<lbrace>\<lambda>a b. valid_pspace' b \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set list \<times> {EPSend}) else state_refs_of' b a) \<and> st_tcb_at' (\<lambda>st. isBlockedOnSend st \<and> blockingObject st = epptr) thread b \<and> ko_at' (Structures_H.endpoint.SendEP list) epptr b \<and> thread \<notin> set list\<rbrace>
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and ?R8767 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep list. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP list\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' ep epptr a \<and> thread \<notin> set x)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. badge && mask 28 = badge \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>a b. UNIV)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' ep epptr a \<and> thread \<notin> set x)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; ep = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x3) (SKIP # hs) (return ()) SKIP
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' ep epptr a \<and> thread \<notin> set x)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> ?Pf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x s)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> ?Rf8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (x = [] \<longrightarrow> True) \<and> (\<forall>xa xb. x = xa # xb \<longrightarrow> (invs' and st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa and ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr and (\<lambda>s. \<forall>x. (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_pspace' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> tcb_at' xa s \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> (valid_objs' and valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb)) s \<and> valid_mdb' s \<and> sch_act_not thread s \<and> xa \<noteq> thread \<and> (\<forall>x xa. thread \<notin> set (ksReadyQueues s (x, xa))) \<and> sch_act_not thread s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> (?R8606 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then {(thread, EPSend)} else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' Structures_H.endpoint.IdleEP epptr a)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> (?R8726 epptra threada canGrantReplya canGranta badgea do_calla blockinga ep x and (\<lambda>s. blocking \<longrightarrow> (tcb_at' thread and Invariants_H.valid_queues and valid_objs' and sch_act_not thread and ep_at' epptr and (\<lambda>s. sch_act_wf (ksSchedulerAction s) s \<and> (\<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) and K (ThreadState_BlockedOnSend = ThreadState_BlockedOnSend \<and> UCAST(32 \<rightarrow> 32) (ptr_val epptra) = epptr \<and> UCAST(32 \<rightarrow> 32) badgea = badgea \<and> UCAST(32 \<rightarrow> 32) canGranta = canGranta \<and> UCAST(32 \<rightarrow> 32) canGrantReplya = canGrantReplya \<and> UCAST(32 \<rightarrow> 32) do_calla = do_calla) and K (epptr = epptr && ~~ mask 4) and K (badgea = badgea && mask 28) and (\<lambda>a. (valid_pspace' and tcb_at' thread and valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call)) a \<and> sym_refs (\<lambda>aa. if aa = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' a)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' a thread. snd r = TCBBound})) aa) \<and> (if thread = thread then K (isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) \<and> blockingObject (Structures_H.thread_state.BlockedOnSend epptr badgea canGrant canGrantReply do_call) = epptr) else st_tcb_at' (\<lambda>a. isBlockedOnSend a \<and> blockingObject a = epptr) thread) a \<and> ko_at' ep epptr a \<and> thread \<notin> set x)) s) and (\<lambda>s. \<not> blocking \<longrightarrow> True)) s)) \<and> s' \<in> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> s \<in> {s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> {s. \<forall>v. dest_'_update (\<lambda>_. v) s \<in> {s. x = [] \<longrightarrow> s \<in> UNIV} \<inter> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. x = xa # xb \<longrightarrow> s \<in> UNIV}}}}} \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Recv\<rbrace> \<inter> - \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}} \<inter> ({s. ep = Structures_H.endpoint.IdleEP \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. ep = Structures_H.endpoint.SendEP x \<longrightarrow> s \<in> ({s. \<forall>v. queue_'_update (\<lambda>_. v) s \<in> UNIV} \<inter> \<lbrace>blockinga \<noteq> 0\<rbrace> \<union> UNIV \<inter> - \<lbrace>blockinga \<noteq> 0\<rbrace>) \<inter> \<lbrace>(case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Send \<or> (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send) = SCAST(32 signed \<rightarrow> 32) EPState_Idle\<rbrace>}})
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa s \<and> ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> tcb_at' xa s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> xa \<noteq> thread \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' Structures_H.endpoint.IdleEP epptr s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x) x s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> thread \<notin> set x))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s' ko. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); projectKO_opt ko = Some ep\<rbrakk> \<Longrightarrow> injectKOS ep = ko
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa s \<and> ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> tcb_at' xa s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> xa \<noteq> thread \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' Structures_H.endpoint.IdleEP epptr s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x) x s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> thread \<notin> set x))
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa s \<and> ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> tcb_at' xa s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> xa \<noteq> thread \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' Structures_H.endpoint.IdleEP epptr s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x) x s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> thread \<notin> set x))
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s; epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)\<rbrakk> \<Longrightarrow> (\<forall>x. ep = Structures_H.endpoint.RecvEP x \<longrightarrow> (\<forall>xa xb. x = xa # xb \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) xa s \<and> ko_at' (Structures_H.endpoint.RecvEP (xa # xb)) epptr s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> xa \<noteq> thread \<and> epptr \<noteq> 0 \<and> tcb_at' xa s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> tcb_at' xa s \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s \<and> xa \<noteq> thread \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> tcb_at' xa s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ep' (case xb of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xb) s \<and> valid_mdb' s \<and> xa \<noteq> thread \<and> thread \<noteq> xa \<and> sch_act_wf (ksSchedulerAction s) s)) \<and> (ep = Structures_H.endpoint.IdleEP \<longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' Structures_H.endpoint.IdleEP epptr s)) \<and> (\<forall>x. ep = Structures_H.endpoint.SendEP x \<longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x) x s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<and> ko_at' (Structures_H.endpoint.SendEP x) epptr s \<and> thread \<notin> set x))
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' x1 x xa. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.RecvEP x1) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x1; x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t s; distinct x1\<rbrakk> \<Longrightarrow> (\<forall>x1a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.RecvEP x1a \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s)
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' x1 x xa. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.RecvEP x1) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x1; x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; \<exists>obj. obj = Structures_H.endpoint.RecvEP x1 \<and> state_refs_of' s epptr = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> (\<forall>x1a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.RecvEP x1a \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. isBlockedOnReceive st \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s)
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' x1 x xa. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.RecvEP x1) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x1; x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t s; distinct x1; state_refs_of' s epptr = set x1 \<times> {EPRecv}; \<forall>x\<in>set x1. st_tcb_at' (\<lambda>ts. \<exists>a. ts = Structures_H.thread_state.BlockedOnReceive epptr a) x s\<rbrakk> \<Longrightarrow> (\<forall>x1a. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.RecvEP x1a \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. (case st of Structures_H.thread_state.BlockedOnReceive v0 v1 \<Rightarrow> True | _ \<Rightarrow> False) \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x1a \<noteq> [] \<and> (\<forall>t\<in>set x1a. tcb_at' t s) \<and> distinct x1a \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> ((case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.IdleEP \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. (case st of Structures_H.thread_state.BlockedOnReceive v0 v1 \<Rightarrow> True | _ \<Rightarrow> False) \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (\<forall>x3. (case xa of [] \<Rightarrow> Structures_H.endpoint.IdleEP | a # list \<Rightarrow> Structures_H.endpoint.RecvEP xa) = Structures_H.endpoint.SendEP x3 \<longrightarrow> x1 = x # xa \<longrightarrow> st_tcb_at' (\<lambda>st. (case st of Structures_H.thread_state.BlockedOnReceive v0 v1 \<Rightarrow> True | _ \<Rightarrow> False) \<and> blockingObject st = epptr) x s \<and> ko_at' (Structures_H.endpoint.RecvEP (x # xa)) epptr s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> cur_tcb' s \<and> tcb_at' thread s \<and> x \<noteq> thread \<and> epptr \<noteq> 0 \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sch_act_wf (ksSchedulerAction s) s \<and> ksCurDomain s \<le> maxDomain \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_pspace' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s \<and> x \<noteq> thread \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> x3 \<noteq> [] \<and> (\<forall>t\<in>set x3. tcb_at' t s) \<and> distinct x3 \<and> valid_mdb' s \<and> x \<noteq> thread \<and> thread \<noteq> x \<and> sch_act_wf (ksSchedulerAction s) s)
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 2. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 3. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' ko obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; sym_refs (state_refs_of' s); simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s\<rbrakk> \<Longrightarrow> ?R8606 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) Structures_H.endpoint.IdleEP s \<and> (blocking \<longrightarrow> valid_objs' s \<and> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a))
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' ko obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; sym_refs (state_refs_of' s); simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a)
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>s s' ko obj x y tp. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; (y, tp) \<in> (if x = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) x); (y, tp) \<notin> state_refs_of' s x\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<in> (if y = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) y)
 2. \<And>s s' ko obj x y tp. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; (y, tp) \<in> state_refs_of' s x; (y, tp) \<notin> (if x = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) x)\<rbrakk> \<Longrightarrow> (x, symreftype tp) \<notin> (if y = epptr then {(thread, EPSend)} else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) y)
 3. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 4. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 5. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>s s' ko obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; (thread, NTFNBound) \<in> state_refs_of' s thread; (thread, TCBBound) \<in> state_refs_of' s thread\<rbrakk> \<Longrightarrow> False
 2. \<And>s s' ko obj y tp. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; (y, tp) \<in> state_refs_of' s thread; tp \<noteq> TCBBound; y \<noteq> epptr; y \<noteq> thread; (thread, symreftype tp) \<in> state_refs_of' s y\<rbrakk> \<Longrightarrow> False
 3. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 4. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 5. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>s s' ko obj y tp. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; state_refs_of' s epptr = {}; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint Structures_H.endpoint.IdleEP); ksPSpace s thread = Some ko; sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; is_aligned thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits); Invariants_H.valid_queues s; (case ko of KOTCB x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some obj; simple' (tcbState obj); ps_clear thread (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; (y, tp) \<in> state_refs_of' s thread; tp \<noteq> TCBBound; y \<noteq> epptr; y \<noteq> thread; (thread, symreftype tp) \<in> state_refs_of' s y\<rbrakk> \<Longrightarrow> False
 2. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 3. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 4. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' Structures_H.endpoint.IdleEP epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> state_refs_of' s epptr = {}
 2. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 3. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; \<exists>obj. obj = Structures_H.endpoint.SendEP x3 \<and> state_refs_of' s epptr = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s\<rbrakk> \<Longrightarrow> ?R8726 (ep_Ptr epptr) (tcb_ptr_to_ctcb_ptr thread) (from_bool canGrantReply) (from_bool canGrant) badge (from_bool do_call) (from_bool blocking) (Structures_H.endpoint.SendEP x3) x3 s \<and> (blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call))
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' (Structures_H.endpoint.SendEP x3) epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s\<rbrakk> \<Longrightarrow> blocking \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> epptr = epptr && ~~ mask 4 \<and> valid_pspace' s \<and> tcb_at' thread s \<and> valid_tcb_state' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) s \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call)
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr epSizeBits; ps_clear epptr epSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread tcbBlockSizeBits; ps_clear thread tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> valid_objs' s \<and> epptr = epptr && ~~ mask 4 \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call)
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr epSizeBits; ps_clear epptr epSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread tcbBlockSizeBits; ps_clear thread tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> epptr = epptr && ~~ mask 4 \<and> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a) \<and> isBlockedOnSend (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call)
 2. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr epSizeBits; ps_clear epptr epSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread tcbBlockSizeBits; ps_clear thread tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> valid_objs' s
 3. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. \<exists>ko. ksPSpace s x = Some ko \<and> is_aligned x (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) \<and> (epptr, TCBBlockedSend) \<in> refs_of' ko \<and> ps_clear x (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch a \<Rightarrow> archObjSize a | _ \<Rightarrow> pageBits) s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr 4; ps_clear epptr 4 s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread 9; ps_clear thread 9 s\<rbrakk> \<Longrightarrow> sym_refs (\<lambda>a. if a = epptr then insert (thread, EPSend) (set x3 \<times> {EPSend}) else ((state_refs_of' s)(thread := tcb_st_refs_of' (Structures_H.thread_state.BlockedOnSend epptr badge canGrant canGrantReply do_call) \<union> {r \<in> state_refs_of' s thread. snd r = TCBBound})) a)
 2. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr epSizeBits; ps_clear epptr epSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread tcbBlockSizeBits; ps_clear thread tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> valid_objs' s
 3. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>s s' x3 obj. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; sch_act_not thread s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); epptr \<noteq> thread; bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s; thread \<notin> set x3; x3 \<noteq> []; \<forall>t\<in>set x3. \<exists>ko. ksPSpace s t = Some ko \<and> is_aligned t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) \<and> (\<exists>obj. ko = KOTCB obj) \<and> ps_clear t (case ko of KOEndpoint x \<Rightarrow> epSizeBits | KONotification x \<Rightarrow> ntfnSizeBits | KOTCB x \<Rightarrow> tcbBlockSizeBits | KOCTE x \<Rightarrow> cteSizeBits | KOArch x \<Rightarrow> archObjSize x | _ \<Rightarrow> pageBits) s; distinct x3; state_refs_of' s epptr = set x3 \<times> {EPSend}; \<forall>x\<in>set x3. ko_wp_at' (\<lambda>ko. (epptr, TCBBlockedSend) \<in> refs_of' ko) x s; valid_pspace' s; ksPSpace s epptr = Some (KOEndpoint (Structures_H.endpoint.SendEP x3)); sch_act_wf (ksSchedulerAction s) s; is_aligned epptr epSizeBits; ps_clear epptr epSizeBits s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; valid_irq_handlers' s; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; kernel_state.ksDomSchedule s = kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (kernel_state.ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; blocking; ksPSpace s thread = Some (KOTCB obj); is_aligned thread tcbBlockSizeBits; ps_clear thread tcbBlockSizeBits s\<rbrakk> \<Longrightarrow> valid_objs' s
 2. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s; \<exists>obj. obj = ep \<and> state_refs_of' s epptr = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of' ko) x s)\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>ep s s'. \<lbrakk>badge && mask 28 = badge; (s, s') \<in> rf_sr; invs' s; st_tcb_at' simple' thread s; sch_act_not thread s; ko_at' ep epptr s; ep_at' epptr s; \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)); valid_obj' (injectKOS ep) s; \<exists>obj. obj = ep \<and> state_refs_of' s epptr = refs_of' (injectKOS obj) \<and> (\<forall>(x, tp)\<in>refs_of' (injectKOS obj). ko_wp_at' (\<lambda>ko. (epptr, symreftype tp) \<in> refs_of' ko) x s); bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s\<rbrakk> \<Longrightarrow> epptr \<noteq> thread \<and> bound_tcb_at' (\<lambda>x. tcb_bound_refs' x = state_refs_of' s thread) thread s \<and> (\<forall>r. (thread, r) \<notin> ep_q_refs_of' ep)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga ep. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ep of Structures_H.endpoint.RecvEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Recv | Structures_H.endpoint.IdleEP \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Idle | Structures_H.endpoint.SendEP x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) EPState_Send)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 2. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>epptra threada canGrantReplya canGranta badgea do_calla blockinga s s'. \<lbrakk>badge && mask 28 = badge; epptra = ep_Ptr epptr; threada = tcb_ptr_to_ctcb_ptr thread; canGrantReplya = from_bool canGrantReply; canGranta = from_bool canGrant; badgea = badge; do_calla = from_bool do_call; blockinga = from_bool blocking; (s, s') \<in> rf_sr; (invs' and st_tcb_at' simple' thread and sch_act_not thread and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p)))) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (ep_at' epptr and (\<lambda>s. \<forall>ep. ko_at' ep epptr s \<longrightarrow> (invs' and st_tcb_at' simple' thread and sch_act_not thread and ko_at' ep epptr and ep_at' epptr and (\<lambda>s. \<forall>d p. thread \<notin> set (ksReadyQueues s (d, p))) and ko_at' ep epptr) s)) s \<and> s' \<in> {s'. \<forall>ep. cendpoint_relation (cslift s') ep (the (cslift s' (ep_Ptr epptr))) \<longrightarrow> s' \<in> UNIV} proof (prove)
goal:
No subgoals!